A missing authorization flaw in the MVPThemes The League WordPress theme allows attackers to bypass the intended access controls and perform actions normally restricted to authorized users. The vulnerability can enable arbitrary modification of theme options or content, potentially leading to defacement, loss of data integrity, or further compromise if the attacker escalates privileges. It is a classic Broken Access Control weakness as identified by its CWE classification.

WordPress installations that have the MVPThemes The League theme version 4.4.1 or earlier installed are affected. Any site running any release of the theme from its initial distribution up through version 4.4.1 is vulnerable, regardless of other plugins or core WordPress version. The core platform itself is not directly impacted.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score below 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to reach the flaw through the web interface, possibly through crafted URLs or form submissions that bypass authorization checks. Although exploitation is unlikely, the moderate impact on site integrity warrants timely remediation.