The vulnerability exists in the Zakra WordPress theme and is caused by a missing capability check in the welcome_notice_import_handler() function. Because the function does not verify that the caller has the required permissions, any authenticated user with Subscriber or higher roles can trigger the demo import. The result is that an attacker can change theme configuration and site settings, effectively modifying the appearance, widgets, and other options that belong to the theme. This constitutes unauthorized data modification and can undermine site integrity and serve as a foothold for further malicious activity once the configuration is altered.

The affected installations are WordPress sites that use the Zakra theme, version 4.1.5 or earlier. All releases up to 4.1.5 inclusive share the flaw; sites that have upgraded to 4.1.6 or newer are no longer vulnerable.

The CVSS score of 4.3 indicates medium severity, and the EPSS score of less than 1% points to a low probability of exploitation at the present time. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires only that the attacker be an authenticated user with a Subscriber or higher role, so the attack vector is remote and credential‑dependent. Once such a user triggers the import, the demonstration settings overwrite existing theme options. The risk is mitigated by updating the theme or disabling the demo import capability for non‑administrators.