A missing authorization check in the WordPress Hive Support plugin up to version 1.2.5 allows attackers to bypass intended access limitations, enabling unauthorized users to manipulate plugin functionality. This broken access control could expose sensitive data or affect configuration settings, aligning with CWE‑862. The potential consequence includes data disclosure, unauthorized modifications, or privilege escalation within the affected WordPress site.

The vulnerability affects the Hive Support plugin distributed by the Hive Support vendor. All releases from the initial version through 1.2.5 are impacted, including installations deployed on WordPress websites that have not applied the latest release.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the issue stems from missing authorization, an attacker could craft HTTP requests to the plugin’s endpoints or exploit misconfigured user roles without needing to compromise authentication. The risk remains when the plugin is accessible publicly, but the low EPSS indicates few observed exploits; however, site administrators should treat it as a valid threat and address it promptly.