The vulnerability resides in the WP Rentals theme provided by sc Internet Vivoo where missing authorization checks allow an attacker to exploit incorrectly configured access control. Because of the broken access control (CWE‑862), an adversary could potentially perform actions beyond their intended permissions, such as modifying rental listings, managing reservations, or accessing sensitive data. The description does not indicate remote code execution or data exfiltration; it simply exposes a privilege escalation within the WordPress environment.

The issue affects the WP Rentals theme from sc Internet Vivoo for all released versions up to and including 3.14.2. Any WordPress site that has this theme installed and is currently using a version not newer than 3.14.2 is vulnerable.

The CVSS score for this issue is 5.3, reflecting a moderate severity. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not a currently exploited public exploit. The lack of an explicit attack vector implies that exploitation likely requires Web access to the WordPress site and may benefit from an existing privileged user account or repeated use of the theme’s administrative interface. While the CVSS rate does not suggest an immediate critical threat, sites that expose these administrative functions to the public should consider the risk significant.