The Reuters Direct plugin for WordPress contains a missing capability verification on the logoff action. This flaw allows any unauthenticated user to trigger a reset of the plugin’s configuration. The result is an unauthorized modification of data that can disrupt site operation or serve as a foothold for attackers who may later reconfigure the plugin in a malicious manner. The weakness is an Authorization Control error, classified as CWE‑862.

All installations of the Reuters Direct WordPress plugin from its initial release through version 3.0.0 are vulnerable. The affected product is the Reuters Direct plugin distributed by the rnags vendor within the WordPress ecosystem.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Attackers would simply need to send a request to the logoff endpoint without authentication; no credentials are required, but the presence of the request must reach the target server. The overall risk is thus moderate but remains non‑negligible, especially for high‑traffic sites where a settings reset could cause significant disruption.