The vulnerability is a missing authorization flaw that permits attackers to bypass the theme’s access control settings in the WordPress Th Shop Mania theme. Without proper authorization checks, an adversary may gain access to functionalities intended for trusted users, potentially compromising the integrity of the theme settings and associated data. The weakness is classified as CWE-862.

WordPress sites that use the ThemeHunk Th Shop Mania theme version 1.9.1 or earlier are impacted.

The flaw has a CVSS score of 7.1, indicating high severity, but no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Attackers may be able to exploit rules that incorrectly limit accessed functionality if they possess legitimate or pre‑existing credentials, although the exact attack surface is not explicitly detailed in the advisory. The risk level remains significant due to the nature of the missing authorization.