The Virusdie – One-click website security plugin for WordPress contains a missing capability check on the vd_get_apikey function, which is exposed via the wp_ajax_virusdie_apikey AJAX endpoint. Authenticated attackers with Subscriber-level permissions or higher can invoke this endpoint and receive the site's Virusdie API key. The exposed API key could allow an attacker to access the site owner's Virusdie account and potentially compromise site security, exposing sensitive configuration and security data.

This vulnerability affects all installations of the Virusdie WordPress plugin up to and including version 1.1.7. Users running Virusdie 1.1.7 or older are at risk; newer releases have patched the missing authorization check.

The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% suggests a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must authenticate to the WordPress site with a Subscriber role or higher and then perform an authenticated AJAX request to the wp_ajax_virusdie_apikey endpoint to retrieve the API key. No elevated privileges or remote code execution are required.