WordPress Responsive Plus plugin versions 3.2.0 and earlier contain a Missing Authorization flaw that allows attackers to bypass normal access controls and exploit incorrectly configured security levels. The vulnerability can lead to unauthorized execution of plugin functions, potentially providing an attacker with sensitive configuration data or the ability to perform administrative operations within the plugin’s scope.

The weakness affects the Responsive Plus plugin from CyberChimps. Any installation of this plugin with a version less than or equal to 3.2.0 on a WordPress site is impacted. Sites that have upgraded to a newer secure version are not affected.

The CVSS score of 5.4 indicates a moderate impact level. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be through the plugin’s HTTP endpoints, where an attacker can craft requests that bypass the plugin’s access controls without needing any user authentication. No additional conditions are stated in the CVE, so an unauthenticated attacker could potentially exploit the flaw by accessing privileged plugin functions.