This vulnerability stems from a missing authorization check in the aDirectory plugin, allowing users to perform actions without proper permission validation. An attacker who can exploit this flaw may read or modify content that should be restricted, leading to unauthorized disclosure or tampering. The weakness corresponds to CWE‑862, an access control issue that can undermine confidentiality and integrity of protected resources.

The aDirectory plugin for WordPress is affected. Any installation using version 3.0.3 or earlier is vulnerable, regardless of the host WordPress version.

The CVSS score of 6.5 indicates moderate severity. With an EPSS score of less than 1%, the probability of exploitation appears low, and the flaw is not listed in CISA's KEV catalog. The attack is likely carried out through the plugin’s web interface, where improper checks allow unauthorized access to privileged actions.