The Flatsome WordPress theme copies a missing authorization flaw that lets an attacker bypass intended access controls and reach or modify content that should be protected. Because the check for user authentication or role is omitted, an unauthenticated or low‑privileged user can execute privileged actions on the site. This integrity and confidentiality compromise can result in the disclosure of sensitive information or the tampering of posts, pages, or custom theme data. The flaw corresponds to CWE-862, missing authorization.

The vulnerability impacts the UX‑themes Flatsome theme version 3.20.5 and earlier. No lower bound is specified in the advisory, so any WordPress installation that has any Flatsome version in that range could be affected. Sites that have not upgraded beyond 3.20.5 are at risk.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface, where an attacker can send crafted HTTP requests to theme‑related URLs and exploit the broken access control to perform actions normally protected by authentication.