The vulnerability is a missing authorization flaw that allows a user to bypass properly configured access control security levels within the WordPress Directorist plugin. Because of this, an attacker who can reach the affected plugin can gain unauthorized access to restricted data or modify content that should be protected. The weakness is identified as CWE-862, which represents missing authorization, and the CVSS score of 7.1 indicates a high severity impact on confidentiality, integrity, and availability.

The issue affects the wpWax Directorist plugin for WordPress, with vulnerable versions ranging from the earliest releases through version 8.6.6. Any WordPress site that has the Directorist plugin installed on a version at or below 8.6.6 is potentially impacted.

The CVSS score of 7.1 signals a significant risk, yet the EPSS score of less than 1% indicates that the probability of exploitation observed in the wild is very low at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. Based on the description, the likely attack vector is a web-based access to the plugin’s administrative or restricted areas, requiring the attacker to have network access to the WordPress installation and the ability to submit crafted requests that exploit the missing authorization checks.