The vulnerability is a Missing Authorization flaw in the Kalon theme for WordPress, allowing an attacker to access or modify content that should be protected by the theme’s access controls. It is identified as CWE-862 and can lead to unauthorized actions within the site, potentially exposing sensitive data or enabling further compromise.

Affected vendors and products include the raratheme Kalon theme. All versions from the earliest available through Kalon version 1.2.9 are impacted; the issue is active on any site using Kalon 1.2.9 or earlier.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% suggests exploitation is currently unlikely. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based request to the WordPress site that leverages the theme’s incorrect access control settings. No specific exploitation conditions are detailed beyond the missing authorization check.