The vulnerability is a broken access control flaw in the Forget About Shortcode Buttons plugin for WordPress. It allows an attacker with inadequate privileges to perform privileged operations or to modify plugin settings, which could lead to unauthorized content changes or further exploitation. The weakness is categorized as CWE‑862, which concerns missing authorization controls.

This issue affects the Code Amp Forget About Shortcode Buttons plugin for WordPress versions 2.1.3 and earlier. It applies to installations of the plugin on any WordPress site that has not been updated beyond version 2.1.3.

The CVSS score of 5.4 indicates a moderate impact, and because the EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, the likelihood of mass exploitation at this time is uncertain. The attack vector is likely through authenticated access to the plugin’s administrative interface or by exploiting the plugin’s URL parameters, given the nature of broken access control.