This vulnerability is a missing authorization flaw in the Metro Magazine theme provided by Rara Themes. Because the theme’s access control levels are improperly configured, users who should not have access to certain administrative or content areas can potentially read or modify protected data. The weakness corresponds to CWE-862 and can lead to unauthorized disclosure, modification, or tampering of WordPress content without proper authentication.

All installations of the Metro Magazine theme from the first releasing version through version 1.4.1 are affected. The issue applies to Rara Themes’ Metro Magazine product. Any WordPress site using a version older than 1.4.2 is potentially vulnerable.

The severity as calculated by CVSS is 6.5, indicating a moderate risk. The EPSS score of less than 1% suggests a low probability of exploit, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through the web interface of the WordPress site, where an unauthenticated or minimally privileged user could exploit the missing authorization to gain access to restricted functions. Because the flaw lies in access control, exploitation would require leveraging any existing permissions associated with a user account, or may be possible without authentication if the theme exposes protected endpoints without checks.