The Spacious WordPress theme contains a missing capability check in the welcome_notice_import_handler function, which allows any authenticated user with Subscriber level or higher to import demo data into the site. This can overwrite existing content or add new entries, leading to unauthorized modification of the website’s data and disrupting its intended appearance or functionality. The vulnerability is a classic missing authorization issue (CWE‑862).

Themegrill’s Spacious theme, up to and including version 1.9.11, is affected. WordPress sites that have installed any of these versions are vulnerable unless they have been upgraded beyond 1.9.11.

The CVSS score of 4.3 denotes moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attacking this flaw requires a valid user account with at least Subscriber permissions, which is typically easy to obtain through legitimate sign‑ups or credential compromise. Once authenticated, an attacker can trigger the import functionality via the site’s admin interface or by sending a crafted request to the relevant endpoint. The attack is non‑remote in that it requires prior authentication, but once authenticated, any user can perform the exploit without additional privileges.