The vulnerability is a missing authorization flaw in the WordPress Ashe theme that permits incorrectly configured access control security levels. As a result, an attacker can gain unauthorized access to privileged functions, potentially exposing data or gaining control over site settings. This weakness is classified as CWE-862, indicating improper restriction of resources or privileges.

The affected product is the Ashe theme by the wproyal vendor. All releases from the earliest available version up to and including version 2.266 are impacted. The theme is widely used within WordPress installations.

No CVSS, EPSS, or KEV data are provided, leaving the precise severity and exploitation likelihood unclear. However, the issue is a classic access‑control flaw, and the likely attack vector is through web requests to the theme’s administrative interfaces. Until a patch or newer version is applied, the risk of an attacker exploiting this vulnerability remains high.