The vulnerability is a missing authorization flaw that allows attackers to access resources restricted to authorized users. Traditional users or attackers with limited privileges could potentially view or manipulate internal plugin data, leading to an integrity breach of the WordPress site’s search functionality.

Vendor Epsiloncool’s WP Fast Total Search plugin version 1.79.262 and earlier are affected. Sites running these versions on any WordPress installation are susceptible.

The CVSS score of 4.3 indicates moderate severity. An EPSS score of less than 1% suggests exploitation is unlikely in the current threat landscape, and the vulnerability is not listed in CISA KEV. Exploitation likely occurs through the plugin’s normal web interface, without requiring an authenticated session; an attacker could send requests to the vulnerable endpoints to read, and possibly modify, search data. No special conditions or additional software are needed.