The vulnerability is an Authentication Bypass Using an Alternate Path or Channel that allows an attacker to gain elevated privileges in the Hossein Material Dashboard plugin. The weakness permits bypassing normal authentication mechanisms, which means an attacker can perform actions normally reserved for authorized users. The consequence is a full escalation of privilege within the WordPress installation, enabling the attacker to modify content, upload malware, or compromise the entire site.

Hossein:Material Dashboard, the Material Dashboard plugin for WordPress, versions up to and including 1.4.5 are affected. All installations of this plugin in that version range are vulnerable.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. This vulnerability is not featured in the CISA KEV catalog. The attack vector is inferred to be remote via the web interface, as the bypass occurs through an alternate web path. The lack of specific exploitation details in the description means that the exploitation likely requires access to the site’s public URLs and the ability to manipulate request paths, but an authenticated session is not necessary to trigger the privilege escalation.