The vulnerability is a Missing Authorization flaw that permits exploitation of incorrectly configured access control security levels. This allows an attacker to bypass normal authorization checks and access content or administrative functions that should be restricted. The flaw is identified as CWE-862, indicating that the system fails to verify the identity or permissions of a user before allowing access. Consequently, an attacker could potentially read, modify, or delete content within the WordPress installation, compromising data confidentiality and integrity.

The affected product is the WordPress theme Perfect Portfolio from raratheme. All releases from the initial version up to and including 1.2.4 are affected. No further granular version information is provided in the vendor or CVE data.

The CVSS score is 5.3, which reflects a medium severity vulnerability. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector, inferred from the description of a broken access control, is an authenticated user or a user with insufficient privileges that can exploit the theme’s misconfigured permissions to gain unauthorized access. No official patch or workaround is currently available, increasing the risk for unpatched systems.