The vulnerability in Mikado‑Themes Verdure allows an attacker to bypass authorization by manipulating user‑controlled keys, leading to insecure direct object references. Exploiting the incorrectly configured access controls, an attacker can access resources that should not be available, potentially exposing sensitive data or modifying content. This flaw aligns with CWE‑639, an access control weakness that undermines the principle of least privilege.

All versions of Mikado‑Themes Verdure up to and including 1.6 are affected. Site owners running Verdure from any earlier unspecified release through 1.6 should be aware that the issue remains present and should take remedial action accordingly.

The CVSS 5.4 score places the vulnerability in the medium severity range, while the EPSS score of less than 1% indicates that exploitation is considered low probability at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, subject to the existence of publicly reachable endpoints that accept user‑supplied keys. An attacker would need to discover or guess a valid access key to read or alter protected resources; the exploitation preconditions are modest, but the impact could compromise confidentiality and integrity of site content.