A missing authorization check in the WordPress Z Companion plugin allows users who are not properly authenticated to access or manipulate content, features, or data that should be restricted. The flaw arises from an incorrectly configured access control layer, enabling unauthorized operations that could lead to privilege escalation, data exposure, or other unwanted changes within the WordPress site. This vulnerability is classified as CWE‑862: Missing Authorization.

The WordPress Z Companion plugin, supplied by wpzita under the name Z Companion, is affected for all releases up to and including version 1.0.13. Any WordPress installation that currently hosts the plugin in these versions may be susceptible to the broken access control flaw.

The CVSS score of 5.4 indicates a moderate impact, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The plugin is publicly available on WordPress installations, so the likely attack vector would involve interaction with the plugin's web interface or exposed endpoints, but this is inferred rather than stated explicitly. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, reducing immediate concern for large-scale attacks.