The Fitness FSE WordPress theme suffers from a broken access control flaw that allows improper authorization checks to be bypassed. This missing authorization can let an attacker gain unauthorized access to administrative or configuration sections of the site, potentially exposing sensitive data or allowing further influence over the site. The effect is primarily a privilege escalation within the theme’s interface, which could enable an attacker to modify or delete content without proper approval.

The vulnerability affects the sparklewpthemes Fitness FSE theme, versions up to and including 1.0.6. Anyone using any of these releases of the theme is impacted.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is reported as < 1 %, implying a very low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog, further suggesting that no widespread or targeted exploitation is known. The precise attack vector is not specified in the advisory; however, given the nature of the flaw, it is likely that an attacker who can interact with the WordPress backend or access theme configuration pages could exploit it, especially if access controls are not tightly enforced.