The Chakra test WordPress plugin has a missing authorization check that allows an attacker to access functions that should be restricted to privileged users. This flaw could let an adversary view, modify, or delete content or configuration settings typically protected by role‑based permissions, thereby compromising the integrity of the site. The vulnerability is classified as CWE-862.

All installations of the Chakra test plugin by Vikas Ratudi running version 1.0.1 or earlier are affected. The issue applies to every WordPress site that has this plugin installed and has not been upgraded beyond the affected releases.

The CVSS score of 4.3 indicates a medium impact with local or network attack vectors. The EPSS score of less than 1% suggests that exploitation of this vulnerability is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, implying that no known exploitation activity has been observed. The attack vector is inferred to be through improperly configured access controls within the plugin, where a user without appropriate privileges can reach protected functionality such as test endpoints or configuration pages.