The vulnerability is a missing authorization flaw that allows exploitation of incorrectly configured access control levels. Attackers can bypass standard permission checks to gain unauthorized access to protected actions via the WordPress Sober theme. This flaw may enable the execution of privileged operations, potentially compromising the integrity and confidentiality of site data.

The weakness affects the WordPress Sober theme built by uixthemes for all installations from any unreleased version through version 3.5.12. Any WordPress website that has not migrated to a newer, unpatched theme version is susceptible.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score below 1% signals a very low probability of real‑world exploitation. Because the flaw is not listed in the KEV catalog, no confirmed public exploit is known. The likely attack vector is via the web interface of the affected theme, requiring authenticated access or presence of a vulnerable configuration. The overall risk remains low due to the limited exploitation likelihood but can be significant if the attacker achieves elevated privileges.