This vulnerability is described as a missing authorization flaw in the Rara Business theme for WordPress, allowing attackers to abuse incorrectly configured access control security levels. The defect permits unauthorized individuals to bypass normal permissions and perform actions that should be restricted to authenticated administrators, potentially exposing or modifying site content and configurations.

Affected systems are WordPress sites that use the Rara Business theme version 1.3.0 or earlier. The vulnerability is present in all releases from the initial public release up to and including 1.3.0, with no earlier version information available.

The CVSS score is 5.3, indicating a moderate impact level. The EPSS score is below 1%, suggesting low current exploitation likelihood, and the vulnerability has not been listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote exploitation through the WordPress admin interface, where an attacker can create or modify content by exploiting the broken access control. The risk could be escalated if the theme handles sensitive data or manages critical site functions.