The Auto x LINE WordPress plugin through version 1.0.0 allows unauthenticated users to invoke certain REST API endpoints without performing any authorization checks. Because of this flaw an attacker can change configuration settings, clear log files, or perform other administrative actions that the plugin would normally reserve for privileged users. The vulnerability is a classic example of an inadequate enforcement of access control, which is reflected in the CWE‑862 identifier. The impact is the potential compromise of the plugin’s configuration and information leakage through log removal, but it does not directly provide arbitrary code execution or compromise of the underlying WordPress installation.

The affected system is the Auto x LINE WordPress plugin for WordPress installations running any version up to and including 1.0.0. No specific WordPress core or PHP version constraints are mentioned in the advisory, so the flaw can affect any site that has the vulnerable plugin installed regardless of the host software stack.

With a CVSS score of 8.2 the vulnerability is considered high. No EPSS score is provided, so the likelihood of exploitation cannot be quantified, but the lack of authentication control suggests that the potential for abuse is significant. The vulnerability is not listed in the CISA KEV catalog, indicating that no known or active exploits have been publicly reported. An attacker could likely exploit the flaw by sending crafted HTTP requests directly to the REST endpoints, assuming network reachability to the WordPress site and that the plugin’s REST API is not otherwise protected by firewalls or access restrictions.