This vulnerability is a missing authorization flaw in the QuanticaLabs Cost Calculator plugin for WordPress, classified as CWE-862. It allows an attacker to bypass access controls on the plugin’s pages or API endpoints, potentially reading or modifying cost calculation data without authentication. The flaw is limited to instances where the plugin is configured with incorrect security levels, providing unauthorized users direct access to protected resources.

The flaw affects the QuanticaLabs Cost Calculator plugin for WordPress, named ql-cost-calculator, versions from the earliest release through and including 7.4. Systems running any of those versions are susceptible.

The published CVSS score of 4.3 indicates moderate impact with high confidentiality and integrity implications but lower availability impact. The EPSS score of less than 1% implies a low probability of active exploitation at the time of reporting, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to target a WordPress site that has the vulnerable plugin installed and be able to send crafted requests to the plugin’s endpoints that lack proper authorization checks.