The vulnerability is a missing authorization flaw affecting the Audio Editor & Recorder plugin for WordPress, rated as CWE‑862. It permits a user to bypass the plugin’s configured access control, allowing them to perform actions or view data that should be limited to users with higher privileges. This can compromise the confidentiality and integrity of the site’s audio content without enabling remote code execution.

Roland Beaussant Audio Editor & Recorder plugin for WordPress. All installations running any version up through and including 2.2.1 are potentially affected. No earlier unlisted versions are specified, so the flaw is believed to exist in every build preceding the patched release.

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score of less than 1% suggests the likelihood of exploitation is low as of now, and the vulnerability is not listed in the CISA KEV catalog. Attacks would most likely occur via the plugin’s web interface, with an attacker needing only regular user access or lower to exploit incorrectly configured access control checks. Elevated network privileges or remote execution paths are not required by the CVE data.