A missing authorization flaw in the Responsive Plus plugin’s import functionality permits triggering page or template imports without adequate access checks. The CVE text does not specify whether authentication is required, so it is unclear if unauthenticated users can exploit the defect; nonetheless, any use of the import endpoint without proper role validation represents a breach of access control and could enable a malicious actor to inject or alter site content, compromising the integrity of the WordPress site.

CyberChimps Responsive Plus plugin for WordPress versions up to and including 3.1.9. Any site that has installed an affected version of the plugin is exposed.

The CVSS score of 5.3 indicates medium severity. The EPSS score of less than 1% suggests that exploitation is currently very unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via HTTP requests to the plugin’s import endpoint, which lacks proper role checks; an attacker would need to reach or send requests to that endpoint, and may need some form of authenticated access to the WordPress site, though the CVE description does not confirm the authentication requirements.