The vulnerability is a missing authorization flaw that allows users to exploit incorrectly configured access control settings. An attacker can gain unauthorized access to resources or functionalities that should be restricted, potentially exposing sensitive data or enabling further compromise. This broken access control directly impacts confidentiality and integrity, as privileged actions can be performed without proper verification.

The affected item is the WordPress Travel Monster theme from the vendor wptravelengine, with versions ranging from any earlier version up to version 1.3.3 inclusive. All installations running those versions are susceptible, regardless of the surrounding WordPress environment.

The CVSS score of 5.3 classifies the issue as medium severity, and the current EPSS score is under 1% indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalogue. The attack vector is inferred to be web‑based, leveraging incorrectly configured security roles; an attacker who can access the site with a user account but lacking the required capabilities could potentially exploit the flaw. Until a patched version is applied, the risk remains until the theme is updated or access controls are manually tightened.