The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control levels in the Bertha AI plugin for WordPress. Based on the description, it is inferred that an unauthorized user can perform privileged actions such as viewing or modifying configuration data or content. The weakness aligns with CWE‑862, indicating improper enforcement of authorization.

Any WordPress site that has the Bertha AI – Andrew Palmer plugin version 1.13 or earlier installed is affected. This includes all releases from the first version up to and including 1.13. The plugin is available as a WordPress plugin and can appear on any domain running WordPress.

The CVSS score of 4.3 classifies the flaw as moderate, and the EPSS score of less than 1% shows a very low probability of exploitation observed in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited exploitation activity. Attackers would likely need to access the plugin’s publicly exposed endpoints or an authenticated WordPress admin session; the lack of proper authentication checks creates a risk of unauthorized use. Because the flaw emerges from misconfigured access levels rather than a fundamental defect in WordPress itself, the attack surface remains relatively narrow but still actionable for sites that use the plugin.