The Coachify theme contains a missing authorization flaw that allows attackers to bypass its intended access controls. By exploiting incorrectly configured security levels, a user can invoke administrative or protected functions without proper permission checks. This flaw can lead to unauthorized access to data or functionality that should be restricted, potentially exposing sensitive information or allowing further compromise of the WordPress site.

WordPress installations that utilize the Coachify theme from wpcoachify, with versions up to and including 1.1.5. Any deployment that has not applied a newer release or an available vendor patch is susceptible.

The CVSS base score of 5.3 indicates medium severity, while the EPSS score of less than 1% suggests that exploitation is presently uncommon. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are known at this time. The likely attack vector is remote over the web, where an unauthenticated or low‑privileged user can interact with the theme’s functions without encountering proper permission checks. Based on the description, it is inferred that the flaw could be leveraged from a web browser or via automated HTTP requests to the site’s front‑end or admin endpoints.