The Mogi theme contains a missing authorization flaw that allows attackers to execute arbitrary WordPress shortcodes. If an attacker can submit a shortcode payload, they can run code on the server, potentially compromising confidentiality, integrity, and availability of the site. This weakness is categorized as a missing authorization control (CWE‑862).

The vulnerability affects the SpabRice Mogi theme for WordPress versions up to and including 1.2.3. Any installation running version 1.2.3 or earlier is at risk; no newer versions are known to be affected.

The CVSS base score of 5.3 indicates a medium severity risk, while the EPSS score of less than 1 % suggests low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers are likely to exploit the flaw via the web interface that accepts shortcode inputs—such as a page or post editor—requiring the ability to deliver a crafted post or similar content. The description indicates missing authorization, so it is inferred that unauthenticated users or authors with minimal permissions may exploit the flaw; however, exact prerequisites are not detailed in the available data.