The vulnerability is a missing authorization flaw that allows an attacker to execute actions normally restricted to privileged users. It is caused by incorrectly configured access control security levels, meaning that users without the required role can exploit protected endpoints, potentially leading to data exposure or manipulation. The weakness is identified as CWE-862, a classic authority bypass.

WordPress sites using the Ays Pro Survey Maker plugin, versions 5.1.9.4 and earlier. No other plugins or versions are affected according to the CNA information.

The CVSS base score of 6.5 indicates high potential impact, but the EPSS score is less than 1%, implying low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active exploitation. The likely attack vector involves a web request made by a logged‑in user, but the flaw could also be triggered by an unauthenticated user if the plugin’s endpoints are publicly accessible. An attacker could modify survey settings, access private survey data, or use the survey functionality to gather credentials.