The vulnerability in the Benevolent theme arises from missing authorization checks that enable the exploitation of incorrectly configured access control security levels. As a result, an attacker who gains a user context may perform actions or view content that should be restricted to privileged users. This issue is formally identified as CWE-862, indicating an authorization flaw that can compromise the integrity and confidentiality of the web application.

The affected product is the raratheme Benevolent theme for WordPress, with all releases from the earliest available version through version 1.3.9 susceptible to this weakness. The precise version range is noted as "from n/a through <= 1.3.9" in the vendor description.

The CVSS score of 5.3 places this vulnerability in the Medium severity range, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not been actively exploited by known threat actors at the time of reporting. The attack vector is inferred to be remote, via the WordPress front‑end or admin interface, assuming an attacker can host or overwrite theme files or otherwise trigger the missing authorization checks. Successful exploitation would allow an unauthenticated user to access protected areas or perform actions reserved for authenticated administrators.