Missing Authorization vulnerability in the WebGeniusLab BigHearts theme allows attackers to bypass correctly configured access control security levels, giving them unauthorized access to functionalities or data that should be restricted. The weakness is classified as CWE-862. This can lead to unauthorized data exposure or manipulation, compromising the confidentiality, integrity, and availability of the website content.

All installations of the BigHearts theme from the earliest available version through and including version 3.1.14 are affected. The affected product is the BigHearts theme provided by WebGeniusLab for WordPress sites.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires an authenticated user with limited privileges to exploit missing authorization checks, allowing that user to perform actions beyond their intended scope. The impact is confined to the WordPress site and does not involve remote code execution or system compromise beyond the scope of the site.