The Ashe WordPress theme, up to version 2.266, contains a missing authorization vulnerability that allows attackers to bypass incorrectly configured access control security levels. This flaw enables unauthorized users to perform privileged actions normally reserved for authenticated administrators, leading to potential data exposure or modification. The weakness is identified as CWE‑862, where authorization checks fail to restrict access to protected resources.

This vulnerability affects the wproyal Ashe theme in any installation running version 2.266 or earlier. No specific patch versions are listed beyond 2.266, so sites using any version up to that threshold are considered vulnerable.

The CVSS score of 4.3 indicates a low severity level, and the EPSS score below 1% suggests a very low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. While the report does not specify a precise attack vector, it is inferred that an attacker would need access to the WordPress administration interface to manipulate the theme’s settings and exploit the broken access control. No public exploits have been reported, and the risk primarily applies to sites that have not updated the Ashe theme beyond version 2.266.