This vulnerability is a broken access control flaw that allows users with the Subscriber role to bypass intended restrictions in the Martfury – WooCommerce Marketplace WordPress Theme. The flaw provides unauthorized privilege escalation within the theme’s functionality, potentially enabling a subscriber to view, modify, or delete marketplace settings and data that should be inaccessible. The weakness is classified as CWE‑862, indicating improper authorization enforcement.

Martfury – WooCommerce Marketplace WordPress Theme versions up to and including 3.2.8 are vulnerable. Deploying any release newer than 3.2.8 eliminates the flaw.

The CVSS score of 4.3 indicates low to moderate severity. The EPSS score of less than 1 % signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale attacks. The description states that the flaw involves subscribers bypassing intended restrictions in the theme. It is inferred that awareness and access to the theme’s administrative interfaces would be necessary for exploitation; these details are not explicitly documented in the CVE data. The exploit is likely to be carried out over the web by an authenticated Subscriber account interacting with protected theme views.