The Golo - City Travel Guide WordPress Theme contains a missing authorization vulnerability (CWE-862) that permits unauthenticated attackers to update any user's password without verifying their identity. This vulnerability affects all versions up to and including 1.6.10. Exploiting this issue allows attackers to reset administrator passwords and gain unauthorized access to accounts, resulting in a critical security breach. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation results in complete account takeover, including administrator accounts, leading to full compromise of the affected WordPress site. Attackers can change passwords without authentication, bypassing all access controls. This can lead to unauthorized data access, site defacement, data loss, or further malicious activities within the compromised environment.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users of the Golo - City Travel Guide WordPress Theme should monitor the vendor's advisory channels for updates and apply any official patches once released. Until a fix is available, restrict access to the WordPress admin area, consider disabling the vulnerable theme, or implement additional access controls to mitigate exploitation risk.