This vulnerability is an incorrect privilege assignment flaw that permits a user with a lower role in WordPress to gain elevated capabilities. The deficiency is classified as CWE‑266, indicating improper permission assignment. An attacker who can authenticate to the WordPress admin can exploit the flaw to obtain higher privileges and perform actions beyond their assigned scope.

The Bowo Admin and Site Enhancements (ASE) plugin for WordPress is affected from the initial release through version 7.6.2.1. Any WordPress site that has this plugin installed in a vulnerable version is at risk; administrators should verify the installed plugin version and confirm it is not one of the releases listed here.

With a CVSS score of 7.5 the vulnerability is considered high risk, yet the EPSS score of <1% indicates a low current probability of exploitation. The attack vector is inferred to require an authenticated user who can access the backend, as the flaw involves assigning higher privileges within the administration interface. The vulnerability is not listed in the CISA KEV catalog, but due to the potential for privilege escalation, timely action is recommended.