The Gauge theme from GhostPool contains a missing authorization flaw that allows an attacker to bypass configured access control levels and gain privileged actions within the WordPress site. This can lead to unauthorized modification of theme settings, content, or the injection of malicious code, thereby compromising the integrity and confidentiality of the site.

GhostPool’s Gauge WordPress theme, version 6.56.4 and earlier, is affected. Installations of any preceding releases up to and including 6.56.4 must be assessed for risk.

With a CVSS score of 7.5 the vulnerability is considered high, but the EPSS score of less than 1% suggests it is unlikely to be widely exploited at present. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to require authenticated access to the WordPress backend or a misconfigured user role, but the CVE description does not specify exact prerequisites. Exploitability would rely on the presence of users with elevated privileges and correct endpoints in the theme. Administrators should treat it as a high‑risk exposure pending a patch.