A missing authorization flaw in CKThemes Flipmart theme allows attackers to perform actions beyond their intended privileges. By exploiting incorrectly configured access control settings, a malicious user could manipulate the WordPress site, potentially modifying or deleting content, theme settings, or other configuration data. The vulnerability is rooted in an authorization deficiency that permits unauthorized execution of privileged functions within the theme.

WordPress installations that include the CKThemes Flipmart theme for versions 2.8 and earlier are affected. The issue impacts sites that have not upgraded beyond the 2.8 release and still rely on the theme’s default configuration.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The weakness is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation likely requires an authenticated user or someone who can log in with sufficient privileges, as the flaw stems from improper access control within the theme’s code. Attackers may leverage known user credentials or employ credential stuffing attacks to gain a foothold and then carry out unauthorized actions.