Missing authorization in WP Performance Pack (Bjoern) versions up to and including 2.5.3 enables an attacker to alter the plugin’s settings or access administrative functions without proper authentication. The weakness corresponds to a broken access control flaw, which can compromise the integrity and privacy of site configuration and potentially expose sensitive data configured by the plugin. The vulnerability is explicit in the CVE description, though specific exploitation steps are not detailed in the available data.

Artists affected are installations of the WP Performance Pack plugin by Bjoern, running any version from the earliest supported releases through 2.5.3. No later releases are affected. If a site uses any of those versions, it is susceptible to the vulnerability.

The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers likely need web access to the plugin’s administrative interface and may exploit the lack of authorization checks to manipulate settings or view protected information. The risk is thus moderate but should be mitigated promptly.