The vulnerability is an Authorization Bypass Through User‑Controlled Key, enabling attackers to perform insecure direct object references within the Mikado‑Themes Dolcino WordPress theme. It allows a malicious user to access, modify, or delete data or functionality intended for higher‑privileged users, posing significant privacy and integrity risks. The weakness is classified as CWE‑639.

Mikado‑Themes Dolcino theme for WordPress, all releases from any pre‑1.6 version up through 1.6, inclusive of 1.6.

The CVSS rating of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need to craft a web request that includes a user‑controlled key or parameter to bypass access controls, exploiting the theme’s improperly configured permissions. Given its moderate impact and low exploitation likelihood, it remains important to patch promptly to prevent potential privilege escalation scenarios.