The flaw is a missing authorization condition that lets unauthorized users exploit an incorrectly configured access control layer in the WP Genealogy plugin. This defect means that anyone who can reach the plugin’s pages may perform privileged actions, such as viewing or editing genealogy data, that should normally be restricted. The weakness is identified as CWE‑862.

The vulnerability affects the WP Genealogy – Your Family History Website plugin released by Black and White. All instances using version 0.1.9 or earlier are potentially vulnerable, including any WordPress site that has installed the plugin within this version range and has it enabled.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the present, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through the WordPress web interface; an attacker only needs the ability to reach the plugin’s administrative endpoints, which may be available to authenticated site users or, depending on site configuration, possibly unauthenticated users. Successful exploitation would allow unauthorized view or modification of genealogy data.