The vulnerability is a missing authorization flaw in the NanoSupport plugin for WordPress. It allows attackers to exploit incorrectly configured access control security levels, enabling them to access or manipulate functionality beyond the intended user privileges.

Affected systems include WordPress installations using the NanoSupport plugin developed by Mayeenul Islam. Versions from the initial release through 0.6.0 are vulnerable. No specific operating system or PHP version is referenced in the advisory; the plugin’s code is the point of vulnerability.

The CVSS score of 4.3 classifies this issue as moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a known, actively exploited weakness. However, if an attacker can reach the plugin’s administrative interfaces, they may gain unauthorized access, potentially leading to data disclosure or site compromise. The likely attack vector is remote via the web interface, as the flaw stems from incorrect authorization checks within plugin code.