The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable because the ajax_dismiss AJAX handler lacks a capability check, allowing an authenticated user with Subscriber-level access or higher to set plugin option values to true. This flaw can be used to trigger errors that deny legitimate users access or to enable features such as registration, thereby disrupting site function or altering configuration state.

All versions of the WordPress plugin Insert Headers and Footers Code – HT Script up to and including 1.1.2 are affected.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% reflects low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated WordPress session and targeting the plugin’s AJAX endpoint; an attacker cannot obtain higher system privileges beyond the existing role.