A missing authorization flaw in the Cache Sniper for Nginx WordPress plugin allows an attacker to bypass intended access controls, potentially accessing or manipulating cached content and configuration data. The vulnerability is identified as CWE-862 and stems from incorrectly configured security levels that do not enforce proper authentication or authorization checks. This can lead to exposure of sensitive information or unintended changes to the site’s caching behavior.

The vulnerability affects the ekaterir Cache Sniper for Nginx plugin (snipe-nginx-cache) for all versions from the earliest available release through 1.0.4.2 inclusive. The affected product is a WordPress plugin that interacts with the Nginx caching layer; any WordPress site that installs this plugin and uses version 1.0.4.2 or earlier is at risk.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s administrative interface or exposed endpoints that are not properly protected; based on the description, it is inferred that the issue arises when access control settings are misconfigured, which an attacker could exploit with or without prior authentication. No additional exploitation conditions are detailed in the advisory.