Missing authorization checks in the Profiler – What Slowing Down Your WP plugin allow attackers to bypass intended access controls and perform actions beyond the privileges of the user. This is a broken access control flaw (CWE‑862) that could enable unauthorized viewing or modification of WordPress content, administrative settings, or other sensitive data. The estimated impact depends on the range of privileges an attacker can gain, but it can lead to data compromise and full site takeover if exploited.

The flaw affects the WordPress plugin Profiler – What Slowing Down Your WP from activity‑log.com, impacting all releases up to and including version 1.0.0. Any website running those versions is vulnerable.

The CVSS score of 6.5 places it in the medium‑to‑high severity range, and the EPSS score of less than 1 % indicates few known live exploits. Nonetheless, the plugin is publicly accessible on the web, so the unlikely but possible attack vector is remote exploitation via a crafted request or access to the plugin’s administration endpoints. The vulnerability is not listed in CISA’s KEV catalog, but because it is a straightforward broken access control flaw, admins should treat it as a valid risk and apply mitigation promptly.