A missing authorization flaw in the WordPress Business Roy theme allows an attacker to exploit incorrectly configured access control security levels. The vulnerability can enable users without proper privileges to perform actions normally reserved for higher‑privileged accounts, potentially affecting data integrity or confidentiality within the site. The weakness is identified as a broken access control issue (CWE‑862).

The condition affects all installations of the Business Roy theme from the earliest release up through version 1.1.4. Users running any of those versions are susceptible; newer releases are not known to contain the flaw.

The CVSS score of 4.3 places the vulnerability in the moderate range, while an EPSS score of less than 1 % indicates a low predicted probability of exploitation at present. The vulnerability is not included in the CISA KEV list. The likely attack vector is via the WordPress administrative interface, inferred from the nature of the access‑control issue, although the description does not explicitly state it. An attacker would need access to the site’s backend to leverage the flaw, making the exploitation contingent on compromised credentials or remote code execution on the server.