The vulnerability is a missing authorization flaw in the Xfinitysoft Content Cloner (super‑seo‑content‑cloner) plugin that lets an unauthenticated user exploit incorrectly configured access control levels. An attacker can invoke the plugin’s cloning functionality without proper permission, which could result in unauthorized duplication of site content, potential tampering, or accidental exposure of sensitive information. The weakness is classified as CWE‑862, indicating improper authorization handling.

WordPress sites that use the Xfinitysoft Content Cloner plugin with versions up to and including 1.0.1. Any deployment of the plugin within this version range is susceptible unless the plugin is updated or removed.

The CVSS score of 4.3 indicates a low severity and the EPSS score of less than 1% shows a very small likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could trigger the cloning operation through the plugin’s interface without authentication, though the precise attack vector is not explicitly documented, so the risk remains largely confined to sites with the plugin enabled and exposed to external traffic.