Technical impact
The Shopwell theme contains a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels. This missing authorization, identified by CWE-862, indicates that certain actions performed through the theme's administrative interface may bypass required permission checks. The CVE description does not specify whether these actions expose read or modify capabilities, so the potential impact remains uncertain but could affect the confidentiality, integrity, or availability of the hosted WordPress site.
Affected Systems
WordPress sites that use the Shopwell theme version 1.0.11 or earlier are affected. The issue applies to all deployments of the vulnerable theme versions prior to the fix and is not limited to any particular WordPress installation.
Risk and Exploitability
The CVSS score of 5.3 reflects medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to access theme‑related administrative endpoints, but the specific privilege level required for exploitation is not detailed. The likely attack vector involves accessing theme configuration pages that lack proper access checks, and exploitation would typically require only the presence of the theme.
