This vulnerability arises from a missing authorization check that allows an attacker to exploit incorrectly configured access control levels within the VillaTheme Core plugin. The flaw enables an attacker to gain unauthorized access to functionality that should be restricted, potentially exposing sensitive data or administrative controls. It is a direct elevation of privilege issue, classified as CWE‑862.

The vulnerability affects installations of the VillaTheme Core plugin for WordPress with versions up to and including 1.0.5. Any WordPress site that has this plugin installed and has not applied the latest update is susceptible.

The CVSS score of 4.3 indicates a moderate risk; the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. Based on the nature of the flaw, the likely attack vector is remote via the web interface, requiring the attacker to craft requests that bypass normal authorization checks. No additional exploitation conditions are explicitly stated in the description. The overall risk remains moderate due to the lack of remote code execution or denial of service, but the potential for unauthorized access justifies timely remediation.