The vulnerability is a missing authorization flaw that permits exploiters to bypass incorrectly configured access control levels in the Wide Banner plugin. An attacker can gain unauthorized access to the plugin’s configuration interface, potentially allowing them to create, modify, or delete banner entries without proper privileges. This broken access control is identified as CWE‑862 and results in a compromise of the integrity of the plugin’s configuration data.

The Wide Banner plugin from the vendor guihom is affected for all releases up to and including version 1.0.4. No other vendor or product versions are listed.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of current exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via a WordPress environment where a user can authenticate and access the plugin’s administrative screens. An attacker with any user-level credentials could potentially exploit the broken access control to manipulate banner settings, leading to unauthorized changes or defacement.