The vulnerability is an authorization bypass through user‑controlled keys in the Mikado‑Themes Cocco theme. It permits attackers to manipulate request parameters and access or modify resources that should otherwise be restricted, compromising the confidentiality and integrity of content managed by the theme. The weakness is categorized as CWE‑639, indicating a problem with access control validation.

The issue affects Mikado‑Themes Cocco theme version 1.5.1 and earlier, as sold for WordPress. Any WordPress site that has installed the theme within that version range is potentially exposed, regardless of the site's hosting environment. Versions newer than 1.5.1 are considered unaffected if the vendor’s patch correctly addresses the IDOR flaw.

The CVSS score of 5.4 denotes moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been widely exploited. Nevertheless, the IDOR can be triggered by crafting URLs or API calls that reference protected objects. An attacker who can guess or modify identifiers could read or overwrite data, potentially enabling content tampering or unauthorized disclosure. The threat level is particularly relevant for sites that rely heavily on the theme for critical content management.