The vulnerability is a missing authorization flaw in the Uriahs Victor Printus WordPress plugin. It allows an attacker to bypass access controls and perform privileged printing operations, potentially exposing sensitive print jobs or infringing on privacy. Classified as CWE‑862, broken access control, the flaw can lead to unauthorized actions that compromise data integrity and availability.

Vendors: Uriahs Victor. Product: Printus plugin for WooCommerce, up to version 1.2.6. The vulnerability applies to any WordPress site that has this plugin installed in a pre‑1.2.7 version, regardless of the configured role.

The CVSS score of 4.3 suggests a moderate impact. The EPSS score of less than 1% indicates a low exploitation likelihood at present, and the flaw is not yet reported in CISA’s KEV catalog. The attack vector is most likely remote, via the web interface, potentially targeting authenticated users with misconfigured roles. Exploitation would require access to a WordPress account that has privileges to use the printing feature, allowing an attacker to trigger privileged print requests without proper authorization.