The vulnerability is a missing authorization flaw in the AnyComment plugin for WordPress. Versions up to 0.3.6 fail to enforce proper access control, allowing an attacker to perform privileged operations—such as reading or modifying comment data—without authentication. The weakness is classified as CWE‑862, which denotes a broken access control mechanism.

Affected systems include WordPress installations that use the Alexander AnyComment plugin with a version that is 0.3.6 or earlier. No specific WordPress core versions are listed, so all installations deploying any of the affected plugin releases are vulnerable. The issue runs from earlier releases through to the listed maximum version, meaning that any site that has not upgraded past 0.3.6 remains at risk.

The CVSS score of 4.3 suggests moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not currently listed in CISA's KEV catalog. Attackers can exploit this flaw from a remote web context, likely by manipulating URLs or form inputs that call the plugin's privileged functions. Removing or restricting those calls until the plugin is patched mitigates the risk.