The vulnerability is a missing authorization flaw in the Israpil Textmetrics plugin, allowing attackers to bypass configured access control levels and perform actions normally reserved for privileged users. This broken access control can enable unauthorized access to plugin data and potentially expose content or configuration settings, compromising confidentiality and integrity within the WordPress site.

Affected products include the WordPress Textmetrics plugin (Israpil Textmetrics) from any version up to and including 3.6.1. Versions newer than 3.6.1 are not impacted by the identified flaw.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires an authenticated user with a role that includes elevated privileges, as the flaw permits bypassing existing security level configurations to gain unauthorized access. No known public exploit exists, and the risk is mitigated by ensuring the plugin is upgraded beyond version 3.6.1.