The Accelerate theme contains a missing capability check on the enqueue_scripts() function, allowing an authenticated user with Subscriber or higher privileges to install and activate the ThemeGrill Demo Importer plugin. This flaw is a classic privilege escalation flaw (CWE‑862) that can lead to unauthorized code deployment and potential compromise of the site.

The affected product is the Accelerate theme for WordPress version 1.5.3 and earlier. Users of the theme at any deployment must verify the current version they are running against the vendor’s updated release.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector is an authenticated user with Subscriber-level access, who can trigger the flaw by executing the enqueue_scripts() function during theme activation or page rendering. Exploitation would require the attacker to possess user credentials, making it a compromise of social engineering or credential theft rather than a remote exploit.