The vulnerability is a missing authorization check in the WPPizza plugin that allows exploitation of incorrectly configured access control levels. An attacker with sufficient access to the plugin’s configuration could perform actions that should be restricted, potentially gaining elevated privileges or modifying sensitive settings within WordPress. This flaw is characterized as a broken access control issue (CWE-862).

The vulnerability affects the WPPizza plugin by ollybach, specifically all versions from the earliest available up to and including version 3.19.8. WordPress sites that have the vulnerable plugin installed are at risk if the plugin’s mechanisms for restricting user capabilities are not properly verified.

The CVSS score of 4.3 indicates a moderate risk level, and the EPSS score of < 1% suggests that real-world exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface, where an authenticated user could manipulate plugin settings or execute privileged commands if role checks are not enforced. Because the flaw is about missing authorization, reaching the plugin’s configuration area is a prerequisite for exploitation.