Missing authorization in the ContentStudio plugin allows attackers to call backend functions that are not properly protected by access control lists. This flaw can lead to unauthorized operations such as retrieving restricted data, modifying settings, or executing arbitrary actions that should be reserved for privileged users. The weakness is categorized as CWE‑862, reflecting an improper validation of permissions. Consequently, an attacker who can reach the plugin’s endpoints may compromise the confidentiality, integrity, or availability of the WordPress site.

The affected product is the WordPress ContentStudio plugin distributed by Contentstudio. Versions from the initial release up through 1.3.7 are affected. Users running any of those releases are vulnerable unless additional configuration limits the exposed endpoints.

With a CVSS score of 5.3, the vulnerability is considered medium severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw by making HTTP requests directly to the plugin’s privileged endpoints, bypassing the standard role checks. The vulnerability could be leveraged by users who do not have administrative privileges, depending on the plugin’s internal permissions.