The WEDOS Global plugin contains a missing authorization flaw that permits users to invoke privileged functions without proper access control. This weakness, classified as CWE-862, enables attackers to perform actions and access data that should be restricted to users with appropriate roles. Consequently, sensitive configuration settings or administrative operations can be compromised by unauthorized actors.

All installations of the WordPress WEDOS Global plugin up to and including version 1.2.2 are vulnerable. The plugin is distributed by wedos.com and integrated into WordPress sites that rely on it for global configuration and management.

The CVSS score of 5.3 indicates moderate severity. The EPSS score, being less than 1%, suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would target the plugin’s admin interfaces over HTTP, taking advantage of the missing ACL to elevate privileges or bypass role restrictions. Such exploitation could lead to unauthorized configuration changes or exposure of sensitive data within the site.