The vulnerability is a missing authorization flaw in the raratheme Lawyer Landing Page theme for WordPress, allowing attackers to exploit incorrectly configured access control security levels (CWE‑862). This broken access control can let unauthorized users gain access to restricted content or configuration settings within the theme, potentially exposing sensitive information or allowing further compromise of the WordPress site. The CVE description confirms the issue arises from improper validation of user permissions.

Affecting the raratheme Lawyer Landing Page WordPress theme, all versions from the initial release up to and including 1.2.7 are impacted. Administrators and site owners using any version of the theme equal to or older than 1.2.7 should consider the vulnerability present.

The vulnerability has a CVSS score of 5.3, indicating moderate risk. The EPSS score is below 1%, suggesting few exploit attempts observed so far, and it is not listed in the CISA KEV catalog. Attackers could potentially exploit the flaw remotely by interacting with the WordPress site, leveraging the theme’s weaknesses in access control. While the current exploitation likelihood appears low, the moderate severity warrants prompt attention to prevent unauthorized access.