Missing authorization in the Dynamic Post plugin permits an attacker to modify configuration settings. The weakness is an inadequate authorization flaw (CWE‑862) that allows unauthorized users to change plugin options, potentially altering site behavior or exposing sensitive data. The impact is the loss of control over plugin configuration rather than a direct code execution vector.

The vulnerability affects Service2Client LLC’s Dynamic Post WordPress plugin up to and including version 5.03. All releases from the initial release through 5.03 are vulnerable; higher versions are not known to be affected.

The CVSS score of 5.4 indicates moderate risk. An EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a web‑based request to the plugin’s settings endpoint, which an authenticated WordPress user lacking sufficient authorization can use to alter configuration, potentially leading to unintended site behavior or exposure of sensitive data.