The vulnerability is a missing authorization flaw that allows an attacker to bypass the plugin’s intended security controls. With this weakness, an unauthorized user could gain access to the plugin’s transfer features and data that should be protected by role or permission checks. The vulnerability is classified as CWE‑862, exposing the plugin to potential confidentiality and integrity risks for any content transferred through it.

WordPress sites running the Smart WeTransfer plugin version 1.3 or earlier, developed by mrityunjay.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, and the issue is not yet listed in the CISA KEV catalog. The flaw manifests when an attacker sends crafted HTTP requests to the plugin’s endpoints without the appropriate authorization, enabling remote exploitation. Because the access controls are incorrectly configured, the attacker can perform unauthenticated actions that should be restricted to privileged users.