The Orchid Store WordPress theme contains a missing authorization check that allows unauthorized users to access or modify restricted administrative functions. As a result, an attacker who gains access to the site could potentially view, edit, or delete sensitive data, thereby compromising the confidentiality and integrity of the WordPress installation. The weakness is classified as CWE-862: Missing Authorization.

All installations of the Orchid Store theme from any earlier release up to and including version 1.5.15 are affected. Users of these versions should identify the installed version and confirm whether it precedes 1.5.16.

The CVSS base score of 5.3 indicates moderate severity; the EPSS score of less than 1% suggests a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Inference indicates that the attack can be carried out via the web interface without any special prerequisites other than network access to the WordPress site. Proper access control is therefore essential to mitigate this risk.