The vulnerability is a missing authorization flaw in the Zapier for WordPress plugin, allowing attackers to invoke protected functions without proper access checks. This could enable unauthorized users to trigger Zapier workflows, create or manipulate data, or perform other privileged actions, leading to potential disclosure, modification, or denial of service to the WordPress site. The weakness is classified as CWE-862, Missing Authorization, indicating that the plugin fails to enforce role-based access controls for certain endpoints.

Zapier for WordPress plugin versions through 1.5.2 are affected, including all earlier releases. The issue applies to any WordPress installation that has the plugin installed at or below 1.5.2, regardless of the WordPress core version.

The CVSS score of 5.4 reflects a moderate impact, but the EPSS score of less than 1% suggests very low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The most likely attack vector is an authenticated WordPress user exploiting the plugin's insufficient checks; it does not appear to be exploitable by unauthenticated external actors based on the provided description.