The ColorMag WordPress theme contains a flaw where the welcome_notice_import_handler() function lacks a capability check. This omission allows any authenticated user with the Subscriber role or higher to invoke the function and install the ThemeGrill Demo Importer plugin without further authorization. The flaw does not grant elevated privileges beyond the user’s existing role, but the unauthorized installation of a plugin can lead to the execution of arbitrary code if a malicious plugin is introduced, a scenario that is inferred from the nature of plugin installation and not explicitly stated in the CVE description.

WordPress sites that have installed the ColorMag theme version 4.0.19 or earlier are affected. Any user granted Subscriber-level access or higher who can log in to the site can trigger the flaw.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only that an authenticated user be able to access the WordPress site; no additional network exposure or special privileges are needed. The attack vector is effectively internal, relying on a valid user account to trigger the unauthorized plugin installation.