The AI Copilot plugin for WordPress suffers a missing authorization flaw that allows incorrectly configured access control levels to be bypassed. This defect means that a user lacking proper privileges can reach and exercise functions that should be restricted, potentially exposing sensitive data or modifying plugin settings. The vulnerability is tied to CWE‑862, representing an absence of verified ownership or clearance checks. The impact is the potential for unauthorized disclosure or alteration of configuration and content within the plugin, affecting confidentiality and integrity at the system level.

The vulnerability affects the quadlayers AI Copilot plugin across all releases up to and including version 1.5.2. Exact version boundaries are unclear from the current data, but any installation running 1.5.2 or earlier is susceptible.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% shows a low probability that the flaw will be actively exploited in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the most plausible attack vector is via the web interface, where an attacker with limited access may perform unauthorized actions that normally require higher privileges. The risk is primarily medium, contingent on the attacker’s access level and the sensitive nature of the data the plugin manages.