The vulnerability is a missing authorization flaw that permits users to exploit incorrectly configured access control levels. Because the plugin fails to enforce proper privilege checks, an attacker can gain unauthorized access to sensitive administration functions or user data. The weakness stems from an insufficient authorization mechanism, which can facilitate data exposure or unauthorized configuration changes.

The issue affects the Icegram plugin for WordPress versions up to and including 3.1.35. Any WordPress site that has the Icegram plugin installed in these or older versions is potentially vulnerable. The plugin is maintained by Icegram and is widely distributed across WordPress installations worldwide.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is very low, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the lack of authorization checks could allow an attacker with network access to the WordPress site to leverage plugin endpoints and perform privileged actions. The attack vector is inferred to be remote, accessing the plugin’s administrative endpoints via the web interface.