The vulnerability is a missing authorization flaw that allows an attacker to abuse incorrectly configured access control settings in the WordPress Pochipp plugin. With the absence of proper privilege checks, an attacker could perform actions that should be restricted, such as modifying plugin settings, creating or deleting content, or executing other privileged operations within the site. This directly compromises data integrity and could elevate an attacker’s privileges on the affected WordPress installation.

The issue affects any WordPress site that has the Pochipp plugin installed and running version 1.18.0 or earlier. It is independent of the WordPress core version and is confined to the plugin’s code base.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path would involve an authenticated user or someone with sufficient access to the site’s admin interface triggering plugin endpoints that lack proper authorization checks. Based on the description, it is inferred that any user who can reach the impacted routes could potentially exploit the flaw to carry out privileged actions.