Missing authorization in the Cream Blog theme allows a user to access restricted functions that should only be available to privileged administrators. The vulnerability is a classic example of CWE‑862, Privilege‑Escalation, where incorrect access control permits expansion of user rights leading to potential data exposure and manipulation of site content. The scope of impact extends to any WordPress site that has installed the affected theme, potentially compromising the integrity of the entire site content and configuration.

WordPress sites using the Cream Blog theme from themebeez, specifically versions up through 2.1.7. The vulnerability is present in all earlier releases, and any site that has not upgraded past this release is affected.

The CVSS base score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low likelihood of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited exploitation reports. Based on the description, the attack vector is likely web‑based, requiring a user with some form of authenticated access to knowledge of the theme’s administrative interfaces. An attacker may then gain escalated privileges by accessing or modifying protected theme settings or content.