The vulnerability is an IDOR flaw that allows an attacker to bypass authorization by controlling a key parameter. This can let an attacker access content or functionality that should be restricted, potentially exposing confidential data and undermining integrity of the site. The weakness is categorized as CWE-639, which reflects missing or incorrect checks on the ownership or permission of an object before allowing update or view. Based on the description, it is inferred that the attack requires the ability to submit crafted HTTP requests containing manipulated identifiers.

The affected product is the Mikado‑Themes Holmes WordPress theme, versions up to and including 1.7. All installations running Holmes 1.7 or earlier are potentially impacted; no minimum vulnerable version is specified.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation at present. The likely attack vector is remote, via crafted requests to the theme’s protected endpoints, and may require user authentication. The problem stems from incorrectly configured access control that fails to validate ownership of requested resources.