The vulnerability is a missing authorization flaw in the Virusdie WordPress plugin that allows attackers to exploit incorrectly configured access control security levels. The flaw is identified as CWE‑862. Based on the description, it is inferred that an attacker could gain unauthorized access to plugin functionality or sensitive information exposed through the plugin’s administrative interfaces, potentially leading to privilege escalation within the host site.

The issue affects the Virusdie plugin for WordPress from any version through 1.1.6. Any WordPress installation that has this plugin installed at version 1.1.6 or earlier is vulnerable; later versions are not impacted.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. It is likely that exploitation would occur via the plugin’s web interface where access control checks are absent; the attacker could target the plugin’s administrative or reporting endpoints without prior authentication. While no active exploits are currently known, the vulnerability could allow privilege escalation within a compromised WordPress installation, making it a concern for site owners.