This vulnerability is authorization bypass that allows an attacker to gain unauthorized access to administrative functionalities or sensitive content within WordPress sites that use the Custom Category/Post Type Post order plugin. The flaw is caused by incorrectly configured access control levels, leading to the CWE-862 weakness. An attacker can exploit this flaw to read, modify, or delete content depending on the privileges of the compromised account.

The flaw affects the faaiq Custom Category/Post Type Post order plugin for WordPress, specifically all releases from the earliest known to version 1.6.0 inclusive. Any site running this plugin within that version range is vulnerable.

The CVSS score of 5.4 indicates a medium severity. The EPSS score of less than 1 percent suggests a low likelihood of being hunted or exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, which also points to limited public exploitation. Based on the description, the likely attack vector involves a WordPress user with limited permissions attempting to elevate privileges or access restricted sections; the attacker would need authentication but could bypass normal role restrictions. Because exploitation does not require arbitrary code execution, the risk to confidentiality, integrity, and availability is moderate relative to other flaws.