The Permalinks Cascade WordPress plugin suffers from a missing authorization flaw in its admin AJAX handler, enabling any authenticated user with subscriber-level permissions or higher to alter essential plugin configuration. The flaw allows changing automatic pinging controls and page exclusion lists, potentially disrupting site telemetry, search engine indexing, or exposing sensitive URLs. While it does not grant code execution or direct data exfiltration, the integrity of the site’s operational settings is compromised, which can affect user experience and SEO performance.

The vulnerability exists in all releases of the Permalinks Cascade plugin up to and including version 2.2. Users who have installed this plugin on any WordPress installation are affected; no specific host or server details are required beyond the presence of the plugin.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The flaw is not catalogued in CISA KEV. The attack path requires an attacker to be authenticated to the WordPress site with a role of Subscriber or higher, after which the attacker can trigger the vulnerable admin endpoint to change plugin settings. No external trigger or additional vulnerability is necessary.