Projectopia projectopia-core contains a missing authorization flaw that allows users to gain unauthorized access to protected resources. The vulnerability stems from incorrect handling of access control security levels, creating a potential for an attacker to elevate privileges or manipulate content. This flaw is identified as CWE-862, which indicates a missing or inadequate authorization control.

WordPress sites running the Projectopia plugin version 5.1.17 or earlier are susceptible. The vulnerability impact covers the entire plugin functionality, affecting users who can upload or edit content depending on the site configuration.

The CVSS score of 6.5 indicates a medium severity risk. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not currently listed in CISA's KEV catalog, implying it has not been observed in the wild. Attackers are likely to exploit this vulnerability by identifying sites with Projectopia 5.1.17 or older and then attempting to access protected actions that should be restricted.