The vulnerability is a missing authorization flaw in the Don Peppe WordPress theme. Because access control checks are incorrectly configured, attackers can gain unauthorized access to theme management features, potentially modifying settings, uploading files, or creating content without permission. This weakness is categorized as CWE-862, indicating that the code fails to check for proper privileges before executing sensitive operations.

The affected product is the Select‑Themes Don Peppe theme for WordPress, with all versions from the initial release up to and including 1.3 susceptible to the flaw.

The CVSS score of 4.3 rates the issue as low severity, and the EPSS score indicates a very small probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, where a web request targeting privileged theme endpoints bypasses authentication checks. While no confirmed public exploits exist, the possibility of abuse exists if the theme is installed in an otherwise secure environment.