The JSM Show Post Metadata plugin for WordPress contains a missing authorization flaw that allows attackers to read post metadata without proper authentication. This weakness, identified as CWE‑862, can expose sensitive content that should be restricted to privileged users, potentially compromising user privacy and site integrity.

The vulnerability affects JS Morisset’s JSM Show Post Metadata plugin, any installation of the plugin version 4.6.0 or earlier.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1% and absence from the CISA KEV catalog suggest low likelihood of current exploitation. The likely attack vector would involve sending unauthenticated HTTP requests to the plugin’s endpoints that lack proper access checks, which could be performed remotely from a web browser or automated script. Because the plugin is accessible via the WordPress administration area, the attack could be carried out by any visitor to the site unless additional access controls are enforced.