The WP Logger plugin for WordPress contains a missing authorization flaw that enables attackers to exploit incorrectly configured access control security levels. Because the plugin lacks proper authentication checks, an attacker can read, modify, or delete logged data that should be restricted. This weakness, identified as CWE-862, could expose sensitive application or user information stored by the plugin.

All installations of the WP Logger plugin by iTRON, from its earliest release up to and including version 2.2, are vulnerable. Sites using WordPress with the WP Logger plugin in these versions must assess their exposure.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Attackers could target the plugin remotely via the site’s web interface; no special privileges are required to access the compromised resources. The overall risk is moderate, limited by the low exploitation probability and the narrow scope to the plugin’s data.