The vulnerability is a missing authorization flaw (CWE-862) that allows an attacker to bypass normal access controls within the WordPress Name Directory plugin. An attacker who can send crafted HTTP requests can access or manipulate data that should be restricted to privileged users, potentially exposing sensitive contact information or altering directory entries. This results in a compromise of confidentiality and integrity of the directory contents, while availability is not directly affected.

The flaw affects the Name Directory plugin by Jeroen Peters, versions from early releases up to and including 1.30.0. All installations running any of those versions are vulnerable until patched.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% shows a very low exploitation probability. The plugin is not listed in the CISA KEV database. The likely attack vector is a web application attack where an authenticated or unauthenticated user sends specially crafted requests to endpoints that should be protected. Exploitation requires no special conditions beyond the presence of the vulnerable plugin.