The problem is a missing authorization flaw (CWE‑862) that allows an attacker to bypass the access controls configured in the VG WORT METIS plugin. An attacker who can reach the plugin’s HTTP endpoints may gain unauthorized access to administrative functions, modify or delete plugin data, or elevate privileges within the WordPress site. The flaw does not provide code‑execution capabilities; its impact is limited to unauthorized data manipulation or privilege escalation.

WordPress sites that run any version of the VG WORT METIS plugin from the original release up through 2.0.1 are affected. The vulnerability applies specifically to the vgwort:VG WORT METIS product line, with the impacted range indicated as n/a through <=2.0.1.

The CVSS score of 6.5 marks the issue as moderately severe, while the EPSS score of <1% suggests a relatively low probability of exploitation, though not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw by sending crafted HTTP requests to plugin endpoints, leveraging the fact that the plugin fails to enforce proper authorization checks. Both authenticated and unauthenticated users could potentially use the flaw if they can infer or guess valid URLs; however, the extent of damage depends on the plugin’s integration with WordPress core capabilities.