An unauthenticated broken access control flaw allows attackers to bypass role‑based checks in the WordPress Motors theme up to and including version 5.6.80, giving them access to privileged functionality that should be restricted to administrators or other high‑privilege users.

Any WordPress installation that has the StylemixThemes Motors theme version 5.6.80 or earlier is vulnerable; newer releases are unaffected. The vulnerability applies regardless of the site’s configured user roles.

The CVSS score of 6.5 indicates moderate severity and the EPSS score of less than 1% shows a low but non‑zero likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be web‑based; an attacker only needs to send crafted requests to a vulnerable site, with no prior authentication required, to reach functions protected by role checks.