The vulnerability is a missing authorization flaw in the acmethemes Education Base WordPress theme that allows attackers to bypass intended access controls. This lacks proper authorization checks and corresponds to CWE‑862, enabling unauthorized reading, modification, or deletion of theme‑related content and compromising a site’s confidentiality and integrity.

WordPress installations that use the acmethemes Education Base theme version 3.0.8 or earlier are vulnerable. All sites deploying any of these versions are at risk until the theme is updated or replaced.

Based on the description, it is inferred that the attack vector is remote through publicly accessible WordPress URLs that invoke theme functions lacking proper authentication. The CVSS score and EPSS are not available, and the vulnerability is not listed in CISA’s KEV catalog. Despite the absence of explicit metrics, the possibility of unauthenticated exploitation of privileged operations indicates a high risk. Attackers would require minimal effort to discover affected endpoints; however, no public exploits or detailed exploitation instructions have been disclosed.