The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme contains a missing authorization vulnerability (CWE-862) in the 'cmsmasters_hide_admin_notice' function. Authenticated users with low privileges (Subscriber and above) can update option values to 'hide' without proper capability checks. This unauthorized modification can cause site errors resulting in denial of service or alter site behavior by setting options like registration to true. The vulnerability affects all versions up to and including 2.0.4. The CVSS 3.1 base score is 4.3 (medium severity), indicating low complexity and no user interaction required for exploitation.

An attacker with Subscriber-level access can exploit this vulnerability to modify option values improperly, potentially causing denial of service by triggering site errors or changing site settings such as enabling user registration. There is no impact on confidentiality or availability beyond denial of service, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unusual changes to site options related to 'cmsmasters_hide_admin_notice'.