A missing authorization check in the Post Grid Master ajax-filter-posts feature allows an attacker to exploit incorrectly configured access control security levels. The flaw, classified as CWE-862, enables access to plugin management actions that should be restricted. No direct elevation of privilege is described, but the lack of proper checks can let users obtain or modify content unintentionally.

The vulnerability affects the WordPress Post Grid Master plugin by Akhtarujjaman Shuvo. All releases from the initial version through version 3.4.17 are impacted.

The CVSS v3 score of 4.3 indicates a medium impact. The EPSS score of less than 1% reflects a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves interacting with the ajax-filter-posts capability from an authenticated user account that lacks proper permission checks; this could be an internal user or an external user with compromised credentials. The vulnerability does not provide a remote code execution path, but it can allow unauthorized manipulation of content or plugin configuration.