The vulnerability occurs in the Greenshift WordPress plugin due to a missing capability check on the gspb_update_global_wp_settings function. This check only verifies that the user has the "edit_posts" capability instead of requiring higher administrative privileges. As a result, any authenticated user with contributor-level access and higher can modify global WordPress theme color settings site‑wide, which can lead to defacement of the site. The weakness is a missing authorization check (CWE‑862).

The affected product is the Greenshift – animation and page builder blocks plugin from wpsoul. Versions up to and including 12.8.9 are vulnerable. Users running any of those releases should verify their installation version.

The CVSS score of 4.3 indicates a low to medium severity vulnerability. No EPSS value is available, and the vulnerability is not listed in CISA KEV, suggesting that exploitation is unlikely in the wild. The attack vector requires an authenticated user with at least contributor privileges, which may be present on many sites. While the impact is limited to cosmetic defacement rather than data loss or remote code execution, it can damage brand trust and site integrity. Overall, the risk is moderate for sites where contributors have ubiquitous access and the plugin’s theme settings are visible to visitors.