Missing authorization controls in the NooTheme CitiLights WordPress theme allow attackers to execute actions reserved for privileged users. The flaw arises from incorrectly configured access control security levels, enabling non‑privileged or unauthenticated users to reach functions normally restricted. As a result, attackers could edit content, manage theme settings, or otherwise alter the site without proper verification, undermining confidentiality and integrity of site data.

The vulnerability affects the NooTheme CitiLights theme for WordPress versions up to, but not including, 3.7.2. Any installation of the theme with a version number less than 3.7.2 is potentially exposed.

The CVSS v3.1 score of 5.3 indicates moderate severity, with a low EPSS of less than 1 %. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is via the web interface; an attacker could manipulate URLs or form inputs that bypass the missing authorization checks. No public exploit code is known, and exploitation would require knowledge of the theme’s internal endpoints or configuration.