Technical impact
The ERI File Library plugin for WordPress contains a missing capability check on its 'erifl_file' AJAX endpoint, which allows an unauthenticated attacker to retrieve files that are normally restricted to certain user roles. This omission is a classic example of CWE-862: Missing Authorization, leading to potential compromise of confidential data on the web server.
Affected Systems
This flaw affects the WordPress plugin ERI File Library version 1.1.0 and all earlier releases, distributed by the vendor apos37 and listed in the WordPress plugin repository. WordPress sites that have the vulnerable plugin installed and the default AJAX action reachable are at risk.
Risk and Exploitability
The CVSS score of 5.3 signals moderate severity with significant impact to confidentiality. The EPSS score is less than 1%, indicating a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. Attackers can remotely probe the site by sending HTTP requests to wp-admin/admin-ajax.php with the action=erifl_file parameter; no authentication is required, making the exploit trivially usable against any publicly accessible WordPress instance running the plugin.
