The vulnerability arises because WP Last Modified Info does not validate that a user has appropriate access before modifying post metadata in the bulk_save AJAX action. As a result, any authenticated user with Author-level privileges or higher can change the last modified timestamp and lock the modification date of any post, including posts owned by administrators. This flaw enables unauthorized modification of post metadata, which can be used to conceal tampering, disrupt auditing processes, or disrupt normal content editing workflows.

The issue affects the WP Last Modified Info plugin for WordPress, specifically all releases up to and including version 1.9.5. The plugin is distributed by infosatech. WordPress sites that have this plugin installed and any authenticated user with Author or higher role are at risk.

With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score indicates a very low likelihood of exploitation (<1%). It is not listed in the CISA KEV catalog, so there is no evidence of widespread commercial exploitation. The attack requires the attacker to be authenticated on the target WordPress site with at least Author-level permissions, and to craft a bulk_save AJAX request that targets arbitrary post IDs. Because the flaw relies on missing authorization checks, it can be weaponized by users already present in the system, but it does not require any additional network access or privilege escalation.