The vulnerability is an example of missing authorization that enables an attacker to invoke plugin functionality that should be restricted to privileged users. Because the plugin fails to enforce access‑control lists, any authenticated user or even unauthenticated visitor could trigger Admin‑level features which could be used to modify content, upload malicious files, or otherwise alter site state. The core weakness matches CWE‑862: Missing Authorization.

Any installation of the Kaira Blockons WordPress plugin up to and including version 1.2.19 is affected. Users running WordPress sites that have this plugin enabled should verify the installed version. All site users whose roles should be limited (e.g., authors, subscribers) are at risk if the plugin does not enforce role limits.

The CVSS score of 7.5 indicates high impact and ease of exploitation. The EPSS score of less than 1% suggests that, at the time of analysis, the probability of seeing an active exploit in the wild is very low, and the vulnerability is not listed in CISA KEV. The CVE description does not specify the exact attack vector; it is inferred that an attacker would likely send crafted HTTP requests to privileged plugin endpoints, bypassing role checks, due to the missing ACL enforcement. The high score reflects the potential for significant damage, however the low EPSS indicates limited real‑world exploitation so far.