The vulnerability is a missing authorization flaw (CWE-862) in the raratheme Construction Landing Page WordPress theme that allows attackers to exploit incorrectly configured access control security levels. This flaw can enable unauthorized users to perform any administrative tasks within the theme’s interface, such as overriding theme configurations, inserting malicious content, or accessing sensitive data stored in the theme settings. The primary impact is loss of integrity and potential confidentiality of theme data, as the flaw does not provide direct code execution but permits unauthorized manipulation of theme functionality.

Affected vendors: raratheme. Product: Construction Landing Page Theme. All releases from the initial deployment up to and including version 1.4.1 are vulnerable, as documented by the vendor.

The CVSS score of 5.3 indicates moderate severity; the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, so it is not known to be actively exploited in the wild. Likely attack vector is through the WordPress web interface, targeting the theme’s administrative pages. Because the flaw is a missing authorization, any user who can reach the theme admin area could potentially exploit it without additional credentials.