A missing authorization check in the WPXPO WowRevenue WordPress plugin allows an attacker to access or modify revenue information without proper authentication. This broken access control flaw is classified as CWE-862 and can compromise the confidentiality and integrity of financial data. The vulnerability is limited to the plugin’s internal data handling and does not induce arbitrary code execution or denial of service.

Any WordPress site that is running the WPXPO WowRevenue plugin version 1.2.13 or earlier. The plugin version range is from the earliest release up to and including 1.2.13.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation reports. Based on the description, the likely attack vector is a remote HTTP request to one of the plugin’s endpoints that bypasses the normal authorization mechanism. No additional prerequisites are mentioned, and the flaw appears to be exploitable by authenticated users with sufficient privileges or by unauthenticated users that can reach the endpoint.