The vulnerability is a missing authorization check in the Magnigenie RestroPress plugin, which allows an attacker through the REST API to perform actions that should be restricted to privileged users. This breaks the intended access controls and can lead to unauthorized data modification or exposure. The weakness is classified as CWE-862, indicating a flaw in the authorization logic within the application.

All installations of the RestroPress WordPress plugin up to and including version 3.2.7 are affected. Users running any of these versions on a WordPress site are at risk.

The CVSS score of 5.3 reflects a moderate severity. The EPSS score of less than 1% indicates that, at present, the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via web requests to the plugin’s REST endpoints, potentially enabling an attacker to execute privileged operations without proper authentication.