The vulnerability is a missing authorization flaw in the Information Technology Wawp automation‑platform plugin that allows attackers to bypass incorrectly configured access control security levels. An attacker could gain unauthorized access to restricted functions or data. The weakness is a classic access‑control bypass (CWE‑862).

This issue affects the Wawp automation‑platform WordPress plugin from any version prior to (and including) 4.4. The vendor is Information Technology Wawp. Versions earlier than 4.4 are impacted, while versions 4.5 and above are presumed fixed. No specific patch versions are listed, but the reference suggests the vulnerability is fixed in newer releases.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, meaning there is no known weaponized exploit targeting it. Attackers would likely need authenticated access or rely on a misconfigured installation to take advantage of the broken access control. The impact is limited to the scope of the vulnerable plugin and the WordPress site it runs on.