This vulnerability allows an attacker to bypass authorization controls by manipulating user‑controlled input values that identify protected resources within the Struktur theme. The flaw is an IDOR (CWE‑639) that permits the retrieval or modification of content without proper ownership or permission verification, potentially exposing sensitive or private data to unauthenticated or improperly authorized users.

The issue affects the Struktur theme provided by Select‑Themes, in all releases from the earliest available version through version 2.5.1.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. The EPSS score is < 1%, suggesting a low likelihood of exploitation. It is not listed in CISA KEV, meaning no known large‑scale exploitation. The attack vector is an IDOR, requiring manipulation of user‑controlled identifiers in the theme’s access‑controlled functionalities. The impact is limited to unauthorized access to content and modification of user‑specific data, without affecting system‑wide denial of service or code execution.