Missing authorization controls in AcmeThemes Education Base theme version 3.0.8 and earlier allow an attacker to bypass protected areas of a WordPress site, enabling unauthorized access to view, edit, or delete content. This weakness, identified as CWE‑862, compromises data confidentiality, integrity, and potentially availability by permitting users without proper credentials to interact with sensitive theme configuration pages.

The vulnerable product is AcmeThemes Education Base, a WordPress theme. All releases from the earliest public version through version 3.0.8 are affected. Site owners using any of these versions face potential unauthorized access to theme settings and content.

The vulnerability has a CVSS score of 5.3, indicating a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, involving crafted HTTP requests to the theme’s configuration or options pages, which bypass access controls and allow unauthenticated or improperly authenticated users to manipulate site content.