Constructor WordPress Theme Missing Authorization Vulnerability in Clean Function

A vulnerability exists in the Constructor theme for WordPress, in all versions through 1.6.5, allowing unauthorized data modification. This issue arises from a lack of capability checks in the clean() function, enabling authenticated attackers with Subscriber-level access or higher to initiate a theme cleaning process.

Impact

Exploitation of this vulnerability allows for unauthorized modification of theme data, specifically through the ability to trigger the clean() function, which removes certain theme options and content.