The MF Plus WPML WordPress plugin contains a missing authorization flaw that permits attackers to alter its configuration settings. Because the settings page can be accessed without proper access control, an attacker could enable or disable features, change site behavior, or expose sensitive information, thereby compromising the integrity of the WordPress installation.

WordPress sites that have the MF Plus WPML plugin installed, version 1.1 or earlier, are vulnerable. Any deployment of this plugin with those versions must be examined for security controls.

The vulnerability is rated with a CVSS score of 6.5, indicating a medium severity impact, and has a very low exploitation probability according to the EPSS score (< 1%). It is not currently listed in the CISA KEV catalog. The flaw is a missing authorization weakness; the likely attack vector is via the WordPress admin interface, where an attacker could send crafted requests to the plugin’s settings endpoint, based on the description, without needing elevated privileges.