This vulnerability allows an unauthenticated user to trigger a denial of service in the Starter Templates by Kadence WP plugin on WordPress installations. The flaw occurs when the plugin processes excessive template requests, exhausting server resources and causing service interruption. It is a resource exhaustion weakness (CWE-770) and carries a CVSS score of 7.5, indicating moderate to high severity.

WordPress sites that have the Starter Templates by Kadence WP plugin version 2.3.3 or earlier. The plugin is distributed by Kadence WP and can be installed via the WordPress plugin repository. Sites running older versions of the plugin and that have not applied the latest patch are vulnerable.

The CVSS score of 7.5 reflects the impact of service interruption, but there is no publicly available exploit code (not listed in CISA KEV) and the EPSS score is not available. The vulnerability is unauthenticated, meaning any visitor can trigger it, typically by accessing public URLs that invoke the plugin’s template handler. Because resource exhaustion can be triggered by repeated requests, the risk remains medium until mitigated. Absence of an active exploit catalog suggests no exploited variants publicly known, but the potential for denial of service persists.