The vulnerability is an Insecure Direct Object Reference (IDOR) that allows an attacker to bypass authorization by providing a user‑controlled key. The flaw arises from incorrectly configured access control security levels in the Mikado‑Themes Fiorello theme. An exploit could enable an unauthenticated or low‑privileged user to retrieve or modify content intended for other users, thereby compromising confidentiality and integrity of site data.

WordPress sites that use the Mikado‑Themes Fiorello theme version 1.0 or earlier. The vulnerability affects all installed instances of this theme on those sites.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread public exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no documented large‑scale attacks have been publicly reported. Based on the description, the likely attack vector is a web‑based request, where an attacker supplies a manipulated key or URL parameter to access data owned by another user. Exploitation requires that the vulnerable theme is installed and that the application fails to validate the requester’s identity against the resource being accessed.