The vulnerability is a missing authorization issue in the raratheme Business One Page theme (versions up to 1.3.2). It allows an attacker to bypass intended access control and gain unauthorized access to protected functions or data within the WordPress site. The weakness is categorized as CWE-862 (Missing Authorization). If successfully exploited, an attacker could read or modify information that should be restricted, impacting the confidentiality and integrity of the site’s content.

WordPress installations that have the raratheme Business One Page theme installed with a version number less than or equal to 1.3.2 are affected. The vulnerability applies to all earlier releases through 1.3.2 as indicated in the vendor’s affected list.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of wild exploitation. The vulnerability is not listed in the CISA KEV catalog. The missing authorization flaw likely requires an attacker to interact with the theme’s interface or API endpoints, presumably via crafted HTTP requests. The probable attack vector is remote through the web, typical of WordPress theme vulnerabilities, but specific exploitation details are not provided in the available description.