Elated-Themes Sweet Jane contains an Authorization Bypass Through User‑Controlled Key flaw that enables an attacker to bypass proper access control checks. This IDOR vulnerability may allow the attacker to retrieve or modify protected content that should not be reachable by their user level, compromising confidentiality and integrity of pages or media managed by the theme. The weakness is classified as CWE‑639.

The flaw affects the Sweet Jane WordPress theme from the earliest available build through version 1.2. All installations of Sweet Jane up to and including 1.2 are vulnerable when deployed on a WordPress site without additional layer of access restriction.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web request that manipulates a user‑controlled key or URL parameter to access protected resources.