The WP Online Contract plugin for WordPress contains a missing capability check on the json_import() and json_export() functions in all versions up to and including 5.1.4. Because of this flaw, unauthenticated users can send requests to the plugin’s import and export endpoints and recover or modify the plugin's configuration settings. This allows an attacker to change how the contract works on the site, or to export the configuration for analysis, thereby compromising the integrity of the WordPress installation.

All installations of the WP Online Contract plugin from its earliest release through version 5.1.4 are impacted. The plugin is developed by the futuredesigngrp team. No known backported fixes exist for these versions, so any site running a vulnerable instance remains at risk until the plugin is updated.

The CVSS score of 6.5 classifies the flaw as medium severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending unauthenticated HTTP requests to the import or export routes, making it a remote, unauthenticated threat that could alter site configuration.