The vulnerability is a Missing Authorization flaw in the WP Wand AI Content Generation plugin (WP Grids). Incorrectly configured access control levels allow an attacker to perform actions that should be restricted. The flaw enables unauthorized users to access or manipulate functionalities reserved for privileged users, potentially exposing sensitive data or making unauthorized changes.

Affected systems include the WP Wand plugin from its earliest releases through version 1.2.5. The plugin is used within WordPress installations, and any instance running 1.2.5 or earlier is potentially vulnerable. The issue applies to all versions up to this point, so checking the installed version is critical.

Risk assessment shows a CVSS score of 5.3, indicating a medium level of severity. The EPSS score is below 1%, suggesting rare exploitation, and the vulnerability is not listed in CISA KEV catalog. Attackers could exploit the flaw by accessing the plugin’s interface from a web browser where access control is improperly enforced, potentially without authentication. The risk remains moderate but can be effectively mitigated by applying the vendor’s patch.