This vulnerability allows an attacker to bypass authorization controls through insecure direct object references, a form of authorization bypass where user-controlled input determines which object is accessed. The flaw arises from improperly configured access‑control security levels in the Innovio theme, enabling an unauthorized user to view or modify content they should not have access to. The weakness aligns with CWE‑639, which focuses on the improper restriction of authority or rights.

WordPress sites using the Mikado‑Themes Innovio theme, version 1.7 and earlier. No lower bound is specified, so any released version up to and including 1.7 may be impacted.

The CVSS score of 5.4 indicates a moderate impact potential, while the EPSS value of less than 1 % suggests a very low probability of exploitation at the time of this assessment. The vulnerability is not listed in CISA’s KEV catalog, and no exploitation is publicly reported. Attackers would likely need to be able to submit or modify user‑controlled parameters in WordPress requests, suggesting a web‑based attack vector, though the exact method is not detailed in the advisory.