The vulnerability in the WooTumblog WordPress plugin allows attackers to inject content due to missing authorization checks. An attacker can use the plugin’s features without proper access control, potentially creating or modifying posts, comments, or other plugin-managed data. This flaw can undermine the integrity of site content and lead to defacement or the insertion of malicious code if the injected content is rendered unfiltered.

WordPress sites running the jeffikus WooTumblog plugin version 2.1.4 or earlier are affected. The vendor responsible for the plugin is jeffikus. No other products or vendors are listed as impacted.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of current exploitation. The flaw is not listed in the CISA KEV catalog, so it has not been confirmed as exploited in the wild. The likely attack vector is a remote web-based request to the plugin’s exposed endpoints, and the flaw is exploitable by unauthenticated or low privileged users. Proper access controls are currently missing, allowing content injection without valid user privileges.