The vulnerability is a missing authorization check in raratheme The Conference theme, which allows exploitation of incorrectly configured access control security levels. The primary impact is unauthorized access to administrative or sensitive functions, potentially leading to data exposure or modification. The weakness is identified as CWE-862, indicating improper restriction of access permissions.

Affected product: raratheme The Conference theme (The Conference). Affected versions: all releases from any earlier version through version 1.2.5 inclusive. Users with these versions are at risk until an update is applied.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack is likely to occur through a web interface or administrative control panel where authorization checks are bypassed; however, the exact attack vector and environmental prerequisites are not explicitly stated in the input and are inferred from the nature of the bug.