The QuickCab WordPress plugin suffers from a missing authorization check that allows users without appropriate administrative privileges to attack the plugin. The flaw is recorded as CWE‑862. Because unauthorized access can be used to modify or view plugin data, it can potentially compromise the integrity of the site’s ordering and logistical functions.

All QuickCab plugin installations at version 1.3.3 or earlier are affected. The vulnerability applies to any WordPress site that has this plugin deployed; no specific WordPress core or theme versions are referenced.

The CVSS score of 5.3 denotes moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. It is inferred that attackers could exploit the missing authorization by sending unauthenticated or partially authenticated HTTP requests to the plugin’s administrative endpoints, based on the typical plugin interface design.