The Droip plugin for WordPress contains a missing capability check in its droip_post_apis() function that is used by several AJAX hooks. Because the function does not verify the current user’s permissions, authenticated users who hold the Subscriber role or higher can invoke these hooks to perform any action that the plugin exposes. The exposed actions include arbitrary post deletion, creation and duplication, updating plugin settings, and manipulating users. The flaw effectively allows a legitimate user with a low‑level role to perform high‑privilege operations and compromises site integrity. This weakness is classified as CWE‑862, missing authorization.

All WordPress sites that have the Droip plugin version 2.2.6 or older are affected. The vulnerability is present in every release upstream from the initial version up to and including 2.2.6 distributed by Themeum. Sites that do not run the plugin, or run a newer version, are not impacted.

The flaw has a CVSS score of 8.8, reflecting a high impact and critical scope. However, the EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation at present. To exploit the issue an attacker must first be able to authenticate to the site with a Subscriber role or higher and then invoke any of the exposed AJAX endpoints. Once authenticated, the attacker can carry out the aforementioned high‑privilege actions until the plugin is updated or mitigated.