The vulnerability in the Heureka plugin for WordPress is a missing authorization flaw that allows users to access features not properly protected by access control lists. This broken access control means an attacker could invoke plugin functions that should be restricted, potentially exposing sensitive data or enabling unintended actions. The weakness is classified as CWE‑862, which indicates improper authorization handling.

Affected systems are installations of Heureka Group’s Heureka WordPress plugin with version 1.1.0 or older. The vulnerability impacts any WordPress site deploying these plugin releases, regardless of other configuration.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through any authenticated WordPress user who can invoke the plugin’s unprotected functions; the lack of explicit details means we infer that an attacker requires sufficient permissions to interact with the plugin’s API endpoints. Without additional exploitation conditions, the risk remains moderate until a patch is applied.