The Miraculous WordPress theme contains a missing authorization flaw that allows users to perform actions normally reserved for site administrators. This broken access control can lead to unauthorized disclosure, modification, or deletion of site content, and can disrupt normal site operations.

All installations of the Miraculous theme created by kamleshyadav that run a version earlier than 2.1.2 are affected. The vulnerability applies to every copy of the theme deployed on a WordPress site, regardless of other configurations, until the official patch is applied.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is relatively unlikely. The vulnerability is not listed in CISA’s KEV catalog, reducing the likelihood of known exploitation. Based on the description, it is inferred that the attack would involve accessing theme files or administrative pages that are not correctly protected, allowing an attacker to elevate privileges or perform unauthorized actions without explicit user confirmation.