The vulnerability resides in weak authentication handling within the Quentn WP plugin, which permits an attacker to elevate privileges on the WordPress site. This flaw, identified as CWE‑1390, allows a user with insufficient rights to acquire full administrative control, potentially leading to complete site compromise.

The flaw affects the Quentn WP plugin from the initial release through version 1.2.8. Users running any version of the plugin up to and including 1.2.8 are vulnerable; no later versions are specified as affected.

The CVSS score of 9.8 reflects the high severity of the attack. Although the EPSS score is less than 1%, indicating a low probability of widespread exploitation at this time, the vulnerability is not listed in the CISA KEV catalog. The description implies that the attack exploits weak or absent authentication checks, most likely through unauthenticated or poorly authenticated plugin endpoints. Once accessed, an attacker could modify settings, create users, and potentially hijack the entire WordPress installation.