The vulnerability is a missing authorization flaw in the Featured Post Creative plugin that allows attackers to exploit incorrectly configured access control levels. This results in unauthorized users being able to perform actions that should be restricted, such as modifying featured posts or accessing administrative settings, as indicated by the CWE-862 association and the description of incorrect configuration.

Affected systems include the WordPress plugin "Featured Post Creative" from Essential Plugin, covering all releases up to and including version 1.5.5.

The CVSS score of 4.3 classifies the issue as low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Although specific exploitation conditions are not detailed in the advisory, the likely attack vector involves web requests to the plugin’s administrative endpoints, permitting attackers who can reach these endpoints to elevate privileges or modify content without correct authorization.