ModelTheme Framework for WordPress contains a missing authorization flaw that enables exploitation of incorrectly configured access control security levels. The vulnerability permits an attacker to reach functionality reserved for administrators, allowing reading or modifying site data, uploading files, or executing arbitrary actions that would normally be restricted. Although the description does not state the exact vector, it is reasonable to assume the flaw is exploitable through crafted HTTP requests to the plugin’s endpoints.

WordPress sites running the ModelTheme Framework plugin version prior to 2.0.0 are affected. The vendor is ModelTheme and the affected product is the ModelTheme Framework. Any installation using an older release is vulnerable.

The CVSS base score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the flaw, an attacker could gain unauthorized access to the plugin’s administrative paths; exploitation would not require specialized skills beyond sending a crafted request, and could be performed remotely if the plugin’s endpoints are publicly reachable.