The Sweet Energy Efficiency WordPress plugin contains a flaw in the sweet_energy_efficiency_action AJAX handler. The plugin fails to perform a capability check, allowing any authenticated user with Subscriber role or higher to execute deletion operations on arbitrary graph data. As a result, attackers can read, modify, and delete graph entries, undermining the integrity of the plugin’s data store. This weakness is classified as CWE‑862, Missing Authorization.

This weakness affects the Sweet Energy Efficiency plugin for WordPress, version 1.0.6 and all earlier releases. The plugin is distributed by wpdirectorykit. A site that hosts WordPress with this plugin up to 1.0.6 is therefore vulnerable; the plugin’s documentation and WordPress plugin repository show that the vulnerable AJAX action exists in those releases.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further implying limited public exploitation. Nevertheless, the flaw can be exploited by any authenticated user who has Subscriber or higher role, making the attack vector internal and reliant on existing account credentials. Once the flaw is abused, data loss or unauthorized modification of graph metadata can occur, directly affecting the integrity of dashboards and reporting.