The vulnerability resides in the activate_modules function of the Sydney WordPress theme, where a missing capability check allows any authenticated user with at least Subscriber privileges to toggle the activation state of theme modules. This flaw creates a privilege escalation scenario that enables attackers to alter the configuration of a site without requiring higher-level administrative rights. While the impact is limited to configuration changes rather than code execution, it can disrupt user experience, hide or misconfigure features, and compromise site integrity.

Sydney WordPress theme developed by athemes, all releases up to and including version 2.56. Any installation of these releases is vulnerable; no specific sub‑versions beyond 2.56 are listed.

The vulnerability has a moderate CVSS score of 5.3, indicating significant but not critical risk. The EPSS score is below 1 %, reflecting a very low probability of exploitation at this time. The issue is not listed in CISA KEV, further reducing its current threat level. Because the attack vector requires an existing authenticated Subscriber account—possibly through credential theft, social engineering, or legitimate content contributors—the vulnerability is more likely if an attacker gains or leverages such credentials.