The VulnId exposes a missing authorization check in the Aruba HiSpeed Cache plugin for WordPress, allowing users to access and modify functionality that should be restricted by access control lists. An attacker who can reach the plugin endpoint can alter cache settings or retrieve sensitive information, potentially compromising site performance and integrity.

WordPress sites running the Aruba HiSpeed Cache plugin version 3.0.3 or older, developed by Aruba.it Dev. All releases prior to 3.0.3 are affected.

With a CVSS score of 6.5, the vulnerability carries moderate severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. The most likely attack vector involves a web request to the plugin’s endpoints, potentially by an authenticated user who lacks proper ACL checks. As the flaw stems from improper access control, it can be leveraged without requiring additional privileges or advanced techniques.