This vulnerability is a missing authorization flaw in the Oneline Lite WordPress theme that allows an attacker to bypass normal access controls. Classified as CWE‑862, the flaw can enable an unauthenticated or minimally privileged user to perform privileged actions such as uploading or modifying theme files, thereby compromising site integrity and potentially executing malicious code.

The affected product is the Oneline Lite theme from themehunk. All releases from the earliest version through version 6.6 are vulnerable, with the latest known vulnerable release being 6.6.

The EPSS score indicates a very low probability of exploitation (<1 %). Nevertheless, because the flaw leads to privilege escalation, the potential damage is significant if an attacker succeeds. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the web interface of the WordPress site; any user with sufficient access to the admin dashboard or who can submit requests to theme files may exploit the broken access control. The CVSS score of 4.3 indicates a moderate level of severity.