An unauthenticated broken access control flaw in the WordPress Motors theme up to and including version 5.6.80 allows attackers to bypass role‑based checks, granting them access to privileged functionality normally restricted to administrators or other high‑privilege users. The vulnerability does not provide direct arbitrary code execution but enables in‑scope actions such as modifying theme options or executing administrative controls that should be limited. This can undermine site security by enabling data tampering or defacement. The weakness aligns with CWE‑862, which denotes access control failures.

Any WordPress installation that uses the StylemixThemes Motors theme version 5.6.80 or earlier is vulnerable; newer releases are unaffected. The problem applies regardless of the site’s configured user roles, making all sites with the affected theme susceptible. No specific operating system or server configuration restrictions are reported.

The CVSS score of 6.5 indicates moderate severity and the EPSS score of less than 1% reveals a low but non‑zero likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be web‑based; an attacker only needs to send crafted requests to a vulnerable site, with no prior authentication required, to reach functions protected by role checks.