The flaw is a missing authorization vulnerability that allows an attacker to exploit incorrectly configured access control security levels. This deficiency, classified as CWE-862, lets unauthenticated or low‑privilege users perform actions reserved for higher‑privileged roles, potentially modifying or deleting data and compromising the integrity and availability of the affected system.

The issue affects e‑plugins Institutions Directory plugin from unspecified minimum versions up through 1.3.4. Based on the plugin’s name and typical usage, it is inferred that this plugin operates within a WordPress site, so administrators should verify that any installations of the plugin in that version range are affected.

With a CVSS score of 7.6, the vulnerability is considered high severity. The EPSS score of < 1% indicates that exploitation is currently uncommon, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via HTTP requests to the plugin’s endpoints, and it would require bypassing normal WordPress authentication controls. Attackers could then elevate privileges within the plugin’s scope to perform unauthorized actions.