This issue is an insecure direct object reference in the ‘funp_ajax_modify_notes’ AJAX endpoint of the Frontend User Notes WordPress plugin. An attacker who is logged in with Subscriber‑level or higher access can modify any note that does not belong to them because the plugin does not validate that the note belongs to the authenticated user. The weakness is a classic IDOR (CWE‑639) that compromises the integrity of user‑generated content and can expose private information hidden in those notes.

The vulnerability affects the Frontend User Notes plugin developed by absikandar. All released versions up to and including 2.1.0 are impacted; newer releases such as 2.1.1 are presumed to contain the fix.

The CVSS score of 4.3 indicates the vulnerability is of moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely to be widespread, and the issue is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated WordPress session with a role of Subscriber or higher and access to the vulnerable AJAX endpoint, making it a local or web‑based attack rather than remotely exploitable from outside the host.