The popular Flatsome theme by UX-themes is vulnerable to a high-severity access control flaw that allows unauthenticated attackers to potentially access sensitive data.

This is a CWE-862 Missing Authorization issue. The theme fails to verify the authorization level of the requester, allowing unauthenticated remote attackers to trigger restricted functions.

With a CVSS score of 7.5, this vulnerability presents a significant risk to the security of websites running the Flatsome theme. Unauthorized access to sensitive theme settings or site data could lead to a complete compromise of site configuration, unauthorized data disclosure, and potential long-term operational disruption.

Immediate Action: Update the Flatsome theme to the latest available version beyond 3.20.5. If an update is not currently available, monitor the vendor's site closely and apply patches as soon as they are released.

Proactive Monitoring: Review server logs for anomalous traffic or unauthorized access attempts targeting the theme's core files and AJAX endpoints.

Compensating Controls: Implement WAF rules to restrict access to the site's administrative or configuration-related endpoints to trusted IP addresses only.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate action from all users of the Flatsome theme. Administrators should prioritize updating the theme to the latest secure version to mitigate the risk of unauthorized access and ensure the ongoing security and integrity of their web environment.