A flaw in the WordPress DK theme allows an unauthenticated attacker to bypass normal access restrictions and perform privileged actions. The vulnerability is categorized as a Broken Access Control and maps to CWE‑862. No authentication is required to exploit the flaw, which means that any user, including anonymous visitors, could potentially gain access to restricted functions, modify content, or gain administration credentials. If successfully exploited, the attacker could take full control of the site, including modifying site content, altering user roles, and potentially installing malicious plugins or themes.

The affected system is the WordPress DK theme by ThemeGoods, with all versions up to and including 3.2.1. These releases are distributed for WordPress sites and are listed as ThemeGoods DK in the CVE entry. No other versions or variants are mentioned as vulnerable.

The CVSS score of 7.5 indicates a high severity for this broken access control flaw. The EPSS score is not available, leaving the current exploitation probability uncertain; the flaw is also not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is remote via the web interface, and no authentication is required. The lack of authentication requirement means that any internet‑connected user can attempt the exploit, potentially compromising site integrity and confidentiality.