The vulnerability is a broken access control flaw that allows callers to invoke plugin functionality that should be restricted by permissions. The missing authorization check means users without proper privileges could access and execute commands intended only for administrators or designated roles, potentially leading to misuse of site functionality and compromise of site integrity.

WordPress sites that have installed OTACKE SNORDIAN's H5PxAPIkatchu plugin version 0.4.14 or earlier are affected. The vulnerability applies to any installation of the plugin through the h5pxapikatchu codebase within the WordPress ecosystem.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests an extremely low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers could invoke the exposed endpoints directly, potentially without authentication if the plugin itself does not enforce user checks, or could exploit the lack of ACLs even after authentication by using privileged roles that are mistakenly allowed. Because no exploit proof or known public exploitation has been reported, the risk remains primarily theoretical and is mitigated by defensive measures.