The vulnerability arises from missing authorization checks in the JetWooBuilder plugin, allowing attackers to invoke functions that should be limited by access control lists. This can result in unauthorized manipulation or execution of plugin features, potentially leading to data tampering, content injection, or other illicit actions within the WordPress site. The flaw is a classic broken access control issue, identified as CWE-862, which permits privilege escalation or unauthorized use of restricted functionality.

WordPress sites that have the Crocoblock JetWooBuilder plugin installed at version 2.1.18 or earlier are affected. The flaw exists in all releases up to that point, and any instance using the plugin in that version range is vulnerable. Administrators should check their site for the presence of the plugin and its version number.

Based on the description, it is inferred that the likely attack vector is direct access to the plugin's endpoints from a remote web browser. With a CVSS score of 7.5 the flaw is considered high severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw by directly accessing the affected plugin endpoints from a remote web browser, bypassing normal role checks and executing privileged operations without appropriate authorization.