The Rankie WordPress plugin contains a missing authorization condition that allows users without proper permissions to execute privileged actions. The plugin fails to enforce its intended access control security levels, meaning that any authenticated user who is not an administrator could potentially access administrative functionalities. If successful, the attacker could read, modify, or delete data managed by Rankie, but no impact on other parts of the WordPress site is indicated by the description.

The vulnerability affects ValvePress Rankie WordPress plugin versions earlier than 1.8.2. Any WordPress installation that has Rankie 1.8.1 or any prior version installed is vulnerable. The affected product is the Rankie plugin provided by ValvePress.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to be authenticated to the site with a role lower than administrator and then use Rankie's web interface to bypass role checks. The overall risk is moderate, but the lack of an active exploit reduces the immediate threat.