WordPress AIO WP Builder contains a missing authorization flaw that lets attackers exploit incorrectly configured access control security levels. When leveraged, the vulnerability permits access to privileged plugin functions that should be restricted, potentially allowing an attacker to modify site content, change settings, or gain further control over the underlying WordPress environment, compromising confidentiality, integrity, and availability of the site. The weakness is classified as CWE‑862.

Endpoint vendor staviravn offers the AIO WP Builder plugin for WordPress. All releases from the initial version up to and including 2.0.2 are affected. The vulnerability does not apply to versions 2.0.3 and higher.

The CVSS score of 7.6 indicates a high severity level. The EPSS score is below 1%, implying that current exploitation activity is minimal. The flaw is not listed in the CISA KEV catalog. Attackers are likely to exploit the weakness by authenticating to a WordPress site (or using an existing attacker-controlled user), then accessing the vulnerable plugin’s administrative pages that are not properly protected. In the absence of a publicly available exploit, the risk remains theoretical but the high CVSS warrants cautious mitigation.