The Malcure Malware Scanner plugin for WordPress suffers a missing authorization flaw that lets attackers bypass intended access restrictions. This flaw stems from incorrectly configured access control security levels and is captured by CWE‑862. An attacker could manipulate or retrieve plugin data without proper privileges, which may lead to unauthorized modifications or data exposure.

The affected product is the Malcure Web Security Malcure Malware Scanner WordPress plugin, versions up through 16.8. Older releases lack a fix.

The CVSS score of 4.3 marks the vulnerability as low severity, and the EPSS score of less than 1% indicates a very small chance of exploitation. It is not listed in the CISA KEV catalog. Likely attack vectors involve remote interaction with the plugin’s administrative endpoints, and the flaw could be exploited by any user with access to the WordPress dashboard or possibly by unauthenticated visitors, depending on the configuration. Exploits would require no additional software but rely on the improper access checks.