The vulnerability is a Missing Authorization flaw in the raratheme Travel Agency WordPress theme which allows exploitation of incorrectly configured access control security levels. This flaw permits unauthorized access to functionality or data that should be restricted. The weakness is classified as CWE-862.

This issue affects installations of the Travel Agency theme from raratheme for WordPress with versions from n/a through 1.5.5 inclusive. Any WordPress site that is running version 1.5.5 or earlier is potentially vulnerable.

With a CVSS score of 5.3 the vulnerability is of moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation in the near term. The attack vector is inferred to be web‑based, whereby an attacker can interact with the WordPress site and send crafted requests to areas that are not properly protected due to incorrect access control configuration. No specific exploitation prerequisites are disclosed in the available information.