The vulnerability is a missing authorization flaw that allows an attacker with access to the Import external attachments interface to perform actions otherwise restricted by role permissions. This broken access control can enable an attacker to import files or view/modify attachments that should be inaccessible, potentially leading to data exposure or tampering. The weakness corresponds to CWE-862, which denotes the absence of proper authorization checks.

The issue impacts the WordPress plugin Import external attachments by ryanpcmcquen for any version up to and including 1.5.12. Sites that use this plugin and have not upgraded beyond the affected releases are susceptible to exploitation.

With a CVSS score of 4.3, the vulnerability is considered moderate, and the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in CISA KEV. Attack vector is inferred to be through the web interface that hosts the import function, requiring that the user is authenticated to a role that should not have import privileges. Exploitation does not need additional software or privileged system access, suggesting it could be performed by any user who can log into the site and manipulate the import feature.