This vulnerability is a missing authorization flaw in the WordPress Instantio plugin that allows an attacker to change settings that are incorrectly protected. Because the plugin fails to verify that callers have the appropriate privileges, the flaw falls under CWE‑862. An attacker who succeeds can modify configuration values, potentially redirecting traffic, manipulating caching behavior, or altering other plugin features that could be leveraged for further exploitation or defacement.

The affected product is the Themefic Instantio plugin for WordPress. Any installation that has a version of the plugin up to and including 3.3.7 is vulnerable. The issue spans all WordPress sites that have instantiated the plugin with these or earlier versions, which may include both self‑hosted and managed WordPress deployments.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of less than 1% shows a low likelihood of exploitation under current conditions. The flaw is not listed in the CISA KEV catalog. Exploitation would require access to a user account with permission to alter plugin settings, implying that administrators or compromised credentials could be the vector. Once the access control check is bypassed, the attacker can make arbitrary changes to the plugin configuration without additional privileges.