The vulnerability is a Missing Authorization issue (CWE-862) in the Restaurant and Cafe WordPress theme. It allows an attacker to bypass intended access controls and perform actions that should be restricted, potentially accessing or manipulating restricted content or administrative functions. The description does not indicate that it leads to remote code execution or data exfiltration, but the loss of proper authorization could undermine confidentiality, integrity, or availability of the site’s sensitive areas.

Affected products are raratheme's Restaurant and Cafe theme for WordPress, with all versions from the initial release up to and including 1.2.5. No other affected versions are specified.

The CVSS base score of 5.3 places this issue in the medium severity range. The EPSS score is below 1%, suggesting a low probability of widespread exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. The description does not detail attack prerequisites; it is inferred that an authenticated user with incorrect configuration could exploit the broken access control, although the exact attack vector is not explicit in the CVE data.