The vulnerability is a missing authorization flaw in the WordPress Arconix Shortcodes plugin that allows an attacker to bypass incorrect access control configurations. By exploiting this weakness, an attacker can gain unauthorized access to plugin settings or content management functions, potentially altering site content or configuration without proper privileges. This type of flaw directly undermines the confidentiality and integrity of the site’s administrative controls.

The issue affects the tychesoftwares Arconix Shortcodes plugin for WordPress, with all versions up to and including 2.1.18 vulnerable. Systems running any of these plugin versions are at risk; no specific WordPress core versions are mentioned.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of current exploitation, though the weakness remains present. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors are remote, via the plugin’s exposed administrative endpoints, requiring an attacker to interact with the site’s interface or send crafted requests. Mitigation hinges on removing or patching the vulnerable plugin to eliminate the access control bypass.