The Rosebud WordPress theme contains an Insecure Direct Object Reference flaw that allows attackers to supply a user‑controlled key to bypass proper authorization checks. This leads to unauthorized viewing or manipulation of protected content or settings within the theme. The vulnerability is identified as CWE‑639, indicating that improper access control underlies the issue.

The vulnerability affects all installations of Mikado‑Themes Rosebud up to and including version 1.4. Sites running any of these versions are vulnerable unless the theme has been upgraded to a later release that addresses the flaw.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% signifies a very low historical probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, suggesting it has not been observed in large‑scale attacks. Based on the description, it is inferred that the likely attack vector is direct manipulation of URL or API parameters that expose object identifiers, a classic IDOR attack. Given the low exploitation likelihood and lack of public exploits, the risk remains moderate but mitigable by timely patching.