a vulnerability in the Melapress File Monitor WordPress plugin allows an attacker to bypass the normal authorization checks that should protect access to the plugin’s functionality. the flaw stems from a missing authorization guard, which is a classic case of improper privilege management (CWE‑862). as a result, an attacker could gain unauthorized access to monitoring features and potentially read or manipulate data that should be restricted, increasing the risk of further compromise.

the vulnerability affects the Melapress File Monitor plugin for WordPress versions earlier than 2.2.0. the affected product is provided by Melapress and is identified by the product name "Melapress File Monitor".

the CVSS score of 5.4 indicates a moderate risk profile, while the EPSS score of less than 1% suggests that exploitation is unlikely at this time. the issue is not listed in CISA’s KEV catalog. the likely attack vector is via the web interface of the WordPress site, where an attacker can send crafted requests to the plugin’s endpoints; based on the description, it is inferred that authentication is either missing or insufficiently enforced, allowing unauthorized users to trigger the vulnerable functionality.