The Flex Mag WordPress theme contains a missing authorization vulnerability (CWE-862) in the propanel_of_ajax_callback() function. This flaw allows authenticated users with low privileges (Subscriber and above) to delete arbitrary options from the WordPress database. Deleting certain options can trigger errors that result in denial of service conditions on the affected site. The vulnerability affects all versions up to and including 3.5.2. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact. No patch or vendor advisory is currently provided.

An attacker with Subscriber-level access can exploit this vulnerability to delete arbitrary option values, potentially causing site errors and denial of service. This compromises the integrity and availability of the affected WordPress site but does not impact confidentiality. The vulnerability does not require high privileges or user interaction, making exploitation feasible once authenticated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious activity related to option deletions. Avoid granting unnecessary privileges to low-level users.