Missing authorization in the FS Poster plugin causes broken access control. A user with a subscriber+ role could potentially gain broader privileges than intended, enabling them to perform site‑wide actions such as additional content publishing, configuration changes or data access. The vulnerability is rated high with a CVSS score of 8.3, indicating considerable risk if exploited.

The vulnerability affects the WordPress FS Poster plugin produced by fs‑code. Versions up to and including 6.5.8 are impacted. Users running any of these versions need to take action.

Since the attack surface is the WordPress web application, an attacker can contact vulnerable endpoints over HTTP/HTTPS, bypassing standard authorization checks. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high CVSS score warrants attention. The likely vector is remote network through the web interface, possibly needing only an authenticated subscriber+ account or could be exploited remotely if the plugin exposes unauthenticated endpoints.