The Prime Listing Manager WordPress plugin through version 1.1 contains a hardcoded secret that allows an attacker to gain administrative privileges without any user account. This flaw bypasses authentication entirely, enabling the attacker to perform any authorized action on the website, such as modifying content, configuring settings, or extracting data. The impact is therefore full control of the site, consistent with an authentication bypass and improper access control weakness.

The vulnerability affects the Prime Listing Manager plugin for WordPress up to and including version 1.1. Any installation using 1.1 or earlier is potentially exposed; no vendor or more granular version data is available beyond this range.

The CVSS base score of 9.8 reflects a critical severity. An EPSS score of less than 1% indicates a low probability of exploitation at this time, though the flaw is known. The vulnerability is not listed in CISA KEV. Assuming a remote attacker can reach the WordPress site, exploitation can be achieved by sending crafted HTTP requests that trigger the plugin’s hardcoded secret mechanism. Because no authenticated session is required beforehand, the attack vector is straightforward for anyone with network access to the host.