Technical impact
The vulnerability in the Hello FSE theme allows an attacker to bypass authorization checks and access theme configuration or content that should be restricted. This could enable unauthorized users to view, modify or delete theme settings, potentially affecting site integrity and confidentiality. The weakness is identified as CWE-862, indicating missing or incorrect inventory of who is allowed to perform certain operations.
Affected Systems
WordPress sites utilizing the SparkleWPThemes Hello FSE theme version 1.0.6 or earlier are affected. No specific WordPress core version is listed, but the issue applies to any deployment where the Hello FSE theme is active and the default access controls are in place.
Risk and Exploitability
The CVSS score of 4.3 denotes moderate risk, while the EPSS score of less than 1% indicates a low likelihood of exploitation at any given time. The vulnerability is not in the CISA KEV catalog, which further suggests limited evidence of widespread exploitation. Based on the description, it is inferred that attackers would need to target sites where the Hello FSE theme is installed and may exploit the broken access checks via normal user interaction or possibly through automated discovery of sensitive theme URLs. No remote code execution or privilege escalation is reported, so the primary threat is unauthorized access to theme configuration and possibly sensitive content.
