A flaw in the Golo WordPress theme assigns incorrect privileges, allowing an attacker to gain higher administrative rights on the site. The vulnerability can enable the creation of new admin accounts or modification of existing ones, giving the attacker full control over site content, settings, and potentially the underlying server environment. The weakness is classified as a privilege escalation vulnerability.

Any WordPress installation that uses the uxper Golo theme version 1.7.0 or earlier is affected. All releases prior to and including 1.7.0 are vulnerable, regardless of the WordPress core version. Site administrators should review their theme usage to determine if the Golo theme is in use and whether it meets the version threshold.

The CVSS score of 9.8 indicates a severe impact, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits. Based on the description, the attack vector likely involves access to the WordPress admin interface or uploading a modified theme file; the exact conditions are not detailed, so the assessment relies on inference from the privilege escalation nature of the fault.