The vulnerability is a missing authorization check that allows users to invoke functions that should be restricted by access-control lists. This broken access control can expose sensitive information or let attackers perform actions not intended for them, raising risks to confidentiality, integrity, and potentially availability of the WordPress site. The severity, as reflected by a CVSS score of 6.5, classifies it as a moderate risk and indicates the weakness is governed by CWE‑862.

The affected software is the WordPress StyleAI plugin developed by relentlo (relentlosoftware). All releases from the earliest version through 1.0.4 are vulnerable. Site administrators using any of these versions should identify the installation location of the plugin within their WordPress installation.

The EPSS score of less than 1% suggests that exploit attempts are expected to be rare, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the missing authorization logic means that any user who can reach the plugin’s endpoints—potentially even unauthenticated visitors—could trigger the protected functions. Attackers with network access to the site or the ability to guess endpoint URLs could therefore exploit the flaw. Until a patch is applied, sites are susceptible to unauthorized actions or data disclosure through this pathway.