Missing authorization in the Rich Text Editor plugin enables an attacker to perform actions typically reserved for higher‑privileged users. The vulnerability arises from incorrectly configured access control security levels, allowing unauthorized users to edit or delete content. This broken access control can compromise the confidentiality, integrity, and availability of site content, and may facilitate privilege escalation for the attacker.

The issue affects the WordPress Rich Text Editor plugin, vendor richtexteditor, version 1.0.1 and earlier. Sites running any of these versions are susceptible to exploitation until addressed.

The CVSS score of 6.5 reflects a moderate severity, and the EPSS score of < 1% indicates a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated session; the attacker exploits the plugin’s editor interface, assuming a role that should not have editing rights, to manipulate site content. Once the vulnerability is exposed, the attacker could insert malicious content or disrupt page rendering.