The vulnerability in the Clear Sucuri Cache plugin allows an attacker to exploit incorrectly configured access controls. The flaw permits unauthorized users to clear or manipulate the cache without proper authorization checks. This results in potential denial of service, service disruption, or malicious content delivery if the cache is tampered with. The weakness is classified as CWE-862: Missing Authorization.

WordPress installations that use the webrangers Clear Sucuri Cache plugin version 1.4 or earlier are affected. The issue originates in all releases from the early releases up to version 1.4, regardless of WordPress core version.

The CVSS base score is 5.3, indicating a medium severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to have authenticated or unauthenticated access to the site and the ability to trigger plugin actions, implying the attack vector could be through the web interface or via a misconfigured user role. The absence of a KEV listing and low EPSS mean that, while the impact is significant for affected sites, the risk of exploitation is comparatively low in the near term.