The Projectopia plugin contains an Insecure Direct Object Reference that allows an attacker to read or manipulate custom role information without proper authorization, thereby compromising the integrity of role‑based permissions.

WordPress sites using the Projectopia plugin version 5.1.25.2 or earlier are affected; the vulnerability exists in the Projectopia core component for WordPress.

The CVSS score of 7.5 highlights a high severity risk. The EPSS score of less than 1% indicates that exploitation is currently rare, and the vulnerability is not present in the CISA KEV catalog. Attacks would require an authenticated user who can supply arbitrary role identifiers, suggesting that the exploitation vector is most likely through legitimate user access lacking proper permission checks.