The LocateAndFilter plugin for WordPress suffers from a missing authorization flaw that allows attackers to invoke features that should only be available to privileged users. This type of vulnerability is classified as broken access control (CWE-862).

All deployments of the dgamoni LocateAndFilter WordPress plugin running version 1.6.16 or earlier are impacted. No specific sub‑versions are listed, so every build up to and including 1.6.16 is considered vulnerable.

The CVSS base score of 5.3 indicates medium severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation as of now, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via HTTP requests to the plugin’s restricted endpoints; this inference is drawn because WordPress plugins are typically accessed through a web interface. No special privileges beyond reaching the relevant endpoints are required for exploitation.