The vulnerability allows an attacker to modify any option of the Residential Address Detection plugin without proper authorization, granting the ability to assume ad‑ministrative privileges within the WordPress installation. Missing authorization checks in the plugin’s option handling mean that changing configuration values is effectively a privilege escalation attack, corresponding to CWE-862.

Eniture Technology’s Residential Address Detection plugin for WordPress, versions up to and including 2.5.4, is affected. Any site still running 2.5.4 or earlier remains at risk.

The CVSS score of 9.8 classifies the flaw as critical, while the EPSS score of < 1 % indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw permits arbitrary modification of plugin options without proper checks, enabling an attacker to elevate privileges, provided they can reach the option interface—most likely through any authenticated user session that has access to the plugin’s settings. No other prerequisites or conditions are documented in the available data.