The News Magazine X theme contains a missing authorization check that permits the exploitation of incorrectly configured access control levels. Attackers could gain unauthorized access to functions that should be restricted to administrators, potentially enabling the modification or deletion of site content or settings. This flaw is a classic example of broken access control (CWE‑862).

WordPress sites that have the News Magazine X theme version 1.2.50 or earlier are affected. Versions beyond 1.2.50 have ceased support for this issue. The vulnerability does not impact WordPress core or other themes.

The CVSS score of 7.5 highlights a high severity issue, while the EPSS score of less than 1 % shows a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is web‑based, involving crafted HTTP requests to the theme’s administrative or public endpoints where the authorization check is missing; this inference is made because the description refers to a missing authorization in web interfaces. Exploitation would require access to these endpoints and a user interface that does not enforce proper permission checks.