This vulnerability is a missing authorization flaw that lets attackers bypass security controls in the Featured Image Generator plugin. By exploiting the incorrectly configured access control levels, an attacker can obtain unauthorized access to plugin functionalities, potentially modifying image generation behavior or executing arbitrary requests on the site.

The issue affects the Aum Watcharapon Featured Image Generator plugin, versions n/a through 1.3.4. Any WordPress installation using an affected plugin version is vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve web requests to plugin endpoints that are accessible to unauthenticated users; the exact path is inferred from the description of incorrectly configured access control.