This vulnerability is a CWE‑862 Missing Authorization flaw within the Hospital Doctor Directory plugin. The plugin lacks proper access control checks, allowing an unauthenticated or minimally privileged user to invoke functions normally reserved for administrators. As a result, attackers could read, modify, or delete doctor profile data, compromising confidentiality, integrity and potentially availability if the functionality is abused widely.

The affected software is the Hospital Doctor Directory plugin developed by e‑plugins. Any installation running version 1.3.9 or older is vulnerable. The plugin is used within WordPress sites to manage doctor directory entries.

With a CVSS score of 7.6 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface of the WordPress site; an attacker can send crafted requests to the plugin’s endpoints to gain unauthorized access. No authentication is required, as the flaw stems from missing access control checks. If an adversary can reach the site, the exploitation is straightforward, but the overall risk is tempered by the low exploitation probability.