The vulnerability is a missing authorization flaw in the WordPress UnGrabber plugin, allowing an attacker to bypass access controls and exploit any functionality the plugin provides. This broken access control can enable the attacker to retrieve, view, or manipulate protected content without the need for valid credentials. The weakness corresponds to CWE‑862 and can compromise the confidentiality, integrity, or availability of the site’s data, depending on how the plugin is used.

All installations of the WordPress UnGrabber plugin by merkulove, version 3.1.3 and earlier, are affected. The issue applies to every variant of the plugin that has not been updated beyond 3.1.3.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the web interface, requiring no authentication and enabling an attacker to access the plugin endpoints directly.