The vulnerability resides in the function 'secupress_reinstall_plugins_admin_ajax_cb' where a missing capability check allows any authenticated user with Subscriber-level access or higher to invoke this AJAX endpoint and install any WordPress plugin of their choice. This bypasses the plugin's intended restriction and effectively grants an attacker the ability to add arbitrary code to the site, creating a path to code execution, privilege escalation, or other malicious activity. The CVSS score of 4.3 indicates a moderate rating, reflecting the constraint that an attacker must already be authenticated.

The issue affects the free edition of the SecuPress WordPress Security plugin, specifically all releases up to and including version 2.3.9. Deployments hosting the plugin on any WordPress installation that allows Subscriber or higher roles are vulnerable. The observable product is SecuPress with Simple SSL – Simple and Performant Security, as documented in the corresponding CPE string.

With an EPSS score of less than 1%, the overall likelihood of exploitation in the wild is low, and the vulnerability has not yet been reported in the CISA KEV catalog. Nevertheless, the attack vector is an application-layer web request that requires authenticated access to a WordPress installation. An attacker must possess a user account with Subscriber or higher privileges, after which they can trigger the unauthenticated installation endpoint to introduce malicious plugins.