The vulnerability is a missing authorization flaw in the Scalenut WordPress plugin. Incorrectly configured access control security levels enable unauthenticated or low‑privilege users to invoke privileged plugin functionalities without proper checks. According to the description, an attacker can exploit this to perform actions that should be restricted, thereby breaching confidentiality, integrity, or availability of site content. The weakness is classified as CWE‑862.

The affected product is the Scalenut WordPress plugin developed by Scalenut, in all releases from the first version through version 1.1.5. Any WordPress site that has this plugin installed and has not been updated to a newer release is vulnerable.

The CVSS score of 7.5 places the issue in the high‑severity range, yet the EPSS score of less than 1 % indicates a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is a broken access control, the attack vector is likely remote and could be performed by any actor who can reach the WordPress installation, possibly without authentication. Successful exploitation would provide the attacker with the same level of access they could achieve by performing the privileged plugin actions.