The WordPress Visual Header plugin suffers from a missing authorization check. Based on the description, it is inferred that an attacker with sufficient access could change plugin header settings. The likely impact would be a compromise of site appearance and potential content injection, impacting the integrity of the site. The vulnerability is classified as CWE-862, indicating an authorization bypass, and the CVSS score of 6.5 reflects a moderate severity.

Affected systems include WordPress installations that have deployed the Visual Header plugin by dastan800, specifically any version up to and including 1.3. Anyone that hosts an affected version is potentially vulnerable.

The risk level is moderate based on the CVSS score. The EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via remote HTTP requests to the plugin’s administrative endpoints, assuming the attacker can reach the site’s front‑end. Because the exploitation does not require privileged credentials beyond a site user with administrative roles, the threat is non‑zero but currently unreported.