This vulnerability is a missing authorization flaw that allows users to access functionality that should be restricted by Access Control Lists. Because the Stop and Block bots plugin does not properly enforce ACLs, an attacker may be able to perform actions normally reserved for privileged users, potentially leading to full site compromise. The weakness is categorized as CWE-862, indicating an authorization defect.

All WordPress installations that use the sminozzi Stop and Block bots plugin with version 1.48 or earlier are affected. The plugin has been identified as vulnerable from its earliest available version through 1.48, inclusive. Site administrators should verify the plugin version and upgrade if necessary.

The CVSS score of 5.3 reflects a moderate severity, and the EPSS score of less than 1% indicates that exploitation is considered unlikely but not impossible. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers could exploit the flaw remotely by sending crafted HTTP requests to the plugin’s administrative endpoints; no prior authentication appears to be required based on the description, making the attack vector accessible to users who can reach the site over the network.