In AndonDesign UDesign Core plugin versions up to 4.14.0 a broken access control flaw allows an attacker to perform actions that should be restricted to privileged users. The missing or incorrect authorization checks enable exploitation of the plugin’s security levels, and the flaw is classified as CWE-862, an Access Control issue. The direct consequence is that an attacker can gain unauthorized access to plugin features or sensitive data, potentially altering content or injecting malicious code into the WordPress site.

The vulnerability impacts the WordPress plugin AndonDesign UDesign Core for all releases up to and including version 4.14.0. No other products or vendor variants are listed as affected within this CVE entry.

The CVSS base score of 6.3 indicates a moderate severity, while an EPSS score of less than 1% signals a relatively low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers likely exploit the flaw by sending crafted HTTP requests to the plugin’s endpoints without needing elevated privileges, leveraging the lack of proper access control checks.