AmentoTech Private Limited’s WPGuppy wpguppy‑lite plugin contains a missing authorization flaw that lets an attacker invoke functions that should be restricted by access control lists. This broken access control may expose sensitive WordPress operations to unauthenticated or improperly privileged users, creating a risk to confidentiality, integrity, and potentially availability of the site. The underlying weakness is CWE‑862, a failure to enforce proper access permissions.

The vulnerability affects the WordPress WPGuppy plugin (wpguppy‑lite) of AmentoTech Private Limited, specifically all releases from the initial release through version 1.1.4. Users running any of these versions on a WordPress installation are susceptible until they upgrade beyond 1.1.4.

With a CVSS score of 8.2 the flaw is considered high severity, while the EPSS score of less than 1 % indicates a very low probability that it is actively exploited. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is a web-based request to a protected plugin endpoint that lacks proper authorization checks; an attacker who can reach the site may trigger these endpoints directly, potentially with or without authentication depending on the site’s configuration. Attackers could then call functions intended only for administrators or for users with specific roles.