A flaw in the Mikado-Themes Curly WordPress theme allows an attacker to bypass access controls by using user-controlled keys. This Authorization Bypass Through User‑Controlled Key vulnerability enables the exploitation of incorrectly configured security levels, potentially allowing a non‑privileged user to read, modify, or delete content that should be restricted. The weakness is technically defined as an IDOR and may compromise the integrity and confidentiality of site data.

WordPress sites that install the Mikado‑Themes Curly theme version 3.3 or earlier are affected. The vulnerability applies to any instance of the theme where default or custom access‑control settings have not been overridden.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of automated exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known large‑scale exploitation. Because the flaw is an IDOR, an attacker would need to craft requests to specific URLs or form inputs exposed by the theme, typically through the public web interface or by interacting with the site's administrative endpoints.