The vulnerability is a missing authorization flaw in the WP AutoKeyword plugin that allows an attacker to bypass configured access control security levels. This flaw can let an unauthenticated or low‑privilege user gain unauthorized access to administrative functions of the WordPress site. The impact is therefore an elevation of privilege that could enable configuration changes or execution of further attacks on the website.

The issue affects the EXEIdeas International WP AutoKeyword plugin up through version 1.0. Users running WordPress with this plugin installed are susceptible unless they have installed a newer iteration.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests low likelihood of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through a web interface that the plugin uses for configuration; access likely requires a user to have an authenticated WordPress account or to find a published admin page that does not enforce the required capability checks.