The CubeWP WordPress plugin suffers from a missing authorization flaw that exposes privileged functions without the necessary ACL checks. This weakness, identified as CWE‑862, permits an attacker to invoke actions that should be restricted, potentially leading to unauthorized data access, modification, or configuration changes. The vulnerability exists in all releases up to and including version 1.1.27.

Imran Tauqeer CubeWP for WordPress, any installation of version 1.1.27 or earlier, is affected. The issue applies to all WordPress sites that have this plugin deployed, regardless of the user role management set up by the site owner.

The CVSS score of 7.5 marks the vulnerability as high severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector would involve accessing the plugin’s specific endpoints through the WordPress administration interface or possibly via crafted requests that bypass normal role checks, allowing an attacker with limited credentials or even no credentials to call the vulnerable functions.