Technical impact
The Rara Academic WordPress theme version 1.2.2 and earlier contains a missing authorization flaw where the theme’s administrative interface does not enforce proper access controls, allowing attackers to perform privileged operations that should be restricted to authorized users. This vulnerability can lead to unauthorized content injection, modification, or deletion, compromising the integrity and confidentiality of the site. The weakness aligns with CWE-862, Missing Authorization.
Affected Systems
This issue affects the Rara Academic theme distributed by raratheme, from the earliest available version up through version 1.2.2 inclusive. Any WordPress installation using one of these theme versions is potentially impacted.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium severity risk, and the EPSS score of less than 1% suggests low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves web-based requests to administrative pages; it is inferred that an attacker may need an authenticated user context to exploit the missing authorization controls, although the description does not explicitly state the requirement for authentication. Given the medium score and low exploit probability, ongoing monitoring and timely patching are advised.
