The vulnerability is a missing authorization flaw that allows an attacker to bypass the intended access control on WP Legal Pages. Because the plugin fails to enforce proper permissions, an attacker can read or modify legal page content, potentially exposing sensitive information or spoofing compliance documents. The weakness is identified as CWE‑862, an insufficiency in access control. The crafted exploit could let a malicious user obtain or alter data that should be confined to privileged administrators.

WP Legal Pages (WPLegalPages) plugin versions up to and including 3.5.4 are affected. Any WordPress installation that has the WPLegalPages plugin enabled and not updated to a newer version is at risk.

The CVSS base score of 7.5 signifies a high severity vulnerability. An EPSS score of less than 1% indicates a very low probability of active exploitation at the time of analysis, and the issue is not yet listed in CISA’s KEV catalog. Attackers could reach the vulnerable plugin via the web interface; they would need to exploit the broken access control on plugin pages, which might require authenticated credentials depending on how the site is configured. The likelihood of exploitation remains low, but the potential impact is significant if the flaw is leveraged to modify legal content or gain further access.