A missing authorization flaw in Dylan James Zephyr Project Manager plugin allows an attacker to exploit incorrectly configured access control levels. The vulnerability, classified as CWE‑862, can enable users without proper privileges to perform actions reserved for higher‑level roles. This could lead to unauthorized data manipulation, project alteration, or other privileged operations within the WordPress site.

Vendors: Dylan James; Product: Zephyr Project Manager plugin for WordPress. Versions from the first release up to and including 3.3.201 are affected. Installations of the plugin on any WordPress site running these versions are susceptible.

The CVSS score of 7.1 indicates a moderate‑to‑high severity vulnerability. EPSS indicates low exploitation probability (<1%), and it is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s web interface, where an authenticated or potentially unauthenticated user with misconfigured roles could invoke privileged functions. While low probability, the impact of successful exploitation could grant attackers significant control over project data and site operations.