The vulnerability is a missing authorization flaw in the StellarWP WPComplete plugin. An attacker can access restricted functions that should be protected by access control lists. This flaw is categorized as CWE‑862 and could allow unauthorized modification of plugin settings, execution of privileged actions, or other sensitive operations that are not meant to be available to all users.

The issue applies to the StellarWP WPComplete installation from the earliest version up to and including 2.9.5.3. Users running any of these versions on a WordPress site are affected. No older or newer releases are known to contain the flaw.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely scenario involves an attacker who can reach the plugin’s endpoints, likely through a web request, and bypasses normal ACL checks to gain unauthorized access to protected functions. Direct exploitation would require the attacker to have network access to the WordPress instance, but no authenticated session is explicitly required according to the description.