WP Directory Kit versions up to 1.4.0 have a broken access control flaw that allows users to perform actions without proper authorization. The vulnerability is classified as a missing authorization weakness (CWE-862) and could enable an attacker to gain inappropriate access to protected functionality, potentially altering site content or data integrity.

The issue affects the WP Directory Kit plugin supplied by WPDirectoryKit, specifically all releases from the earliest to 1.4.0. Any WordPress site installing this plugin version is potentially vulnerable.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further indicating limited active exploitation. Inferred from the description, exploitation likely requires HTTP access to the plugin’s administrative endpoints, making it an application‑layer, remote vulnerability that can be leveraged using valid user credentials or by elevating privileges if an account with higher role permissions is compromised.