The plugin suffers from a missing authorization check that allows any authenticated or potentially unauthenticated user to alter background color settings. This flaw enables an attacker to modify visual aspects of the site’s editor beyond the intended user role, effectively escalating privileges within the WordPress environment. The vulnerability is rooted in incorrect access control configuration and is classified as CWE-862.

The affected software is the FADI MED Editor Wysiwyg Background Color plugin for WordPress, versions from n/a through 1.0. Users running any of these versions are susceptible.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker could exploit the issue by sending crafted HTTP requests to the plugin’s endpoints, bypassing the usual role checks. However, the requirement for the target to have some level of access to the site’s backend reduces the reach of the vulnerability.