This vulnerability, identified as a missing authorization flaw, allows attackers to manipulate image size settings within WordPress. By leveraging the plugin’s configuration endpoints, an attacker can create custom image sizes or disable existing ones, potentially compromising the way media is handled on the site. The weakness aligns with CWE‑862, indicating that the plugin fails to enforce proper access control checks.

The affected software is GrandPlugins’ Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin, specifically any release version up to and including 1.0.10. There is no broader product coverage beyond this plugin, and versions newer than 1.0.10 are not impacted based on the information given.

The CVSS score of 4.3 places this vulnerability in the moderate range, suggesting that the potential impact is limited to configuration changes rather than full compromise. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation appears to be achievable via the plugin’s administrative interface or exposed API endpoints, and would likely require the ability to authenticate on the WordPress site, though the exact vector is not explicitly stated. Given the moderate severity and low exploit likelihood, the risk is considered moderate but warrants timely mitigation.