Technical impact
Based on the description, the missing authorization flaw in the WordPress Crumber plugin allows attackers to execute privileged actions without proper authentication. This flaw exposes the plugin’s administrative interfaces to any user with sufficient access to the WordPress environment, potentially enabling modification or deletion of data within the plugin’s scope. The defect is classified as a CWE-862 weakness, indicating improper authorization logic that can lead to unauthorized access and manipulation of content.
Affected Systems
The Crumber plugin by merkulove, versions up to 1.0.10 inclusive, is affected. Sites that have installed any of these versions on a WordPress platform are at risk.
Risk and Exploitability
The CVSS score of 5.4 denotes a medium severity impact, and the EPSS score of < 1% indicates a very low probability of exploitation as of the latest assessment. The vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread attacks. Based on the description, it is inferred that attackers would exploit the flaw by submitting crafted requests to the plugin’s administrative endpoints via the web interface, necessitating only that the target be accessible and that the attacker can send HTTP requests to the site.
