The vulnerability is a missing authorization flaw that allows attackers to bypass the authentication mechanism in AmentoTech Private Limited’s WPGuppy plugin, enabling them to access privileged administrative functions that should be restricted. Because the plugin’s access control is incorrectly implemented, an unauthenticated user could perform actions such as modifying content, changing settings, or potentially taking full control of the WordPress site. This direct unauthorized access flaw corresponds to CWE-862 and could lead to data exposure, integrity violations, or availability disruptions for sites that rely on WPGuppy.

The affected product is AmentoTech Private Limited’s WPGuppy WordPress plugin, versions up to and including 1.1.0. Any WordPress installation that has installed a version of WPGuppy 1.1.0 or older is potentially vulnerable, regardless of which theme or other plugins are active.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploit at the time of this analysis. Attackers can reach the flaw through normal web traffic to the WordPress site; they require no special network access beyond the ability to send HTTP requests to the target. The failure of access control means any attacker who discovers the vulnerable plugin instance can potentially perform privileged actions, provided that the WordPress site’s user role configuration allows administrative access once the flaw is exploited.