Technical impact
This vulnerability allows any unauthenticated user to gain elevated privileges by exploiting the WordPress Jawn theme in versions 1.4.2 and earlier. The flaw can be triggered without login, enabling an attacker to create or modify administrator accounts, thereby compromising the entire site. The weakness is identified as CWE-266, reflecting improper restriction of privileges.
Affected Systems
The Jawn theme from the vendor MVPThemes is affected in all releases up to and including version 1.4.2. WordPress installations that are using one of these versions are at risk unless upgraded to a later release that patches the flaw.
Risk and Exploitability
The CVSS score of 9.8 indicates critical severity. No EPSS data is available, but the fact that the bug is unauthenticated and the vulnerability is listed as Privilege Escalation increases the likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, though the danger remains high. An attacker can launch the exploit from any Internet-accessible WordPress instance that runs the vulnerable theme, leading to full administrative control.
