Due to a missing authorization check in G5Theme G5Plus April, attackers may access or modify functions that are intended to be restricted. The vulnerability facilitates exploitation of incorrectly configured access control security levels, potentially enabling unauthorized content modification or elevation of privileges on a WordPress site. The weakness is categorized as CWE‑862: Missing Authorization.

The issue affects deployments of the G5Plus April theme for WordPress, versions up to and including 6.8. Admins and users of WordPress sites that have installed this theme are therefore exposed.

The CVSS rating of 5.3 indicates a medium severity risk. The EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to reach the vulnerable code through normal web requests targeting the theme’s administrative interfaces; however, this is inferred from the nature of the missing authorization checks, as the explicit attack vector is not detailed in the description.