The Mikado‑Themes Overton WordPress theme contains an authorization bypass through user‑controlled key vulnerability, allowing attackers to manipulate identifiers to access, modify, or delete content or files that should be restricted to privileged users. This flaw corresponds to CWE‑639 and can result in exposure of confidential data and tampering of site content.

All installations of the Overton theme from the earliest release through version 1.3 on WordPress sites are affected. Any site that has not applied a newer version of the theme remains vulnerable.

The CVSS v3.1 score is 5.4, indicating moderate severity. The EPSS score is below 1 %, suggesting a very low current likelihood of exploitation, and the vulnerability is not listed in one of the KEV catalogs. Based on the description, it is inferred that an attacker can exploit the flaw by crafting HTTP requests to the theme’s endpoints without needing advanced authentication. While exploitation is straightforward from a technical standpoint, the lack of publicly disclosed exploits and the low EPSS reduce the immediate urgency, yet timely patching is still prudent.