The Graphina plugin lacks proper authorization checks, which allows attackers to perform actions that should be restricted. This broken access control can enable the exploitation of incorrectly configured access control security levels, potentially granting unauthorized users the ability to modify or delete content, create posts, or access sensitive data. The weakness is classified as CWE-862, indicating an access control failure.

The vulnerability affects Iqonic Design Graphina versions from all releases up to 3.0.4, inclusive. Any WordPress site running the Graphina plugin at or below 3.0.4 is potentially exposed.

The CVSS score of 5.4 indicates moderate impact. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and it is not listed in the CISA KEV catalog. The vulnerability can be exploited by leveraging incorrect access control settings, typically through web-based interactions with the plugin’s endpoints. An attacker who can trigger the plugin’s functionality without proper authorization could gain the capability to modify content or perform privileged actions.