The clarified flaw allows users to bypass required authentication checks and exploit improperly configured access control within the Clariti WordPress plugin. Because the plugin does not enforce correct role verification, an attacker could read or modify data the user should not have access to, thereby violating confidentiality and integrity of site content. This is a classic example of missing authorization weaknesses (CWE-862).

The issue affects all installations of the Clariti plugin with version 1.2.1 or older. Those sites that rely on the plugin for managing content or user data are at risk if the plugin remains unpatched or misconfigured. The plugin is commonly deployed on WordPress sites that use Clariti as a resource management tool.

With a CVSS score of 5.4, the severity is moderate, yet the EPSS score of less than 1% indicates that currently it is a low-visibility vulnerability. The vulnerability is not listed in the CISA KEV catalog, implying no known mass exploitation. The most likely attack vector is remote through the web interface because the plugin is exposed via WordPress admin pages; however, the description does not explicitly detail the vector, so it is inferred.