The vulnerability is a missing authorization flaw that allows an attacker to bypass the security levels configured within the WordPress WDV One Page Docs plugin. As a result, users with insufficient privileges could gain access to functions intended only for higher privileged users, potentially exposing or modifying protected content. The primary impact is a breach of confidentiality and integrity within the plugin’s scope; no remote code execution or denial of service is indicated.

The flaw affects the WDV One Page Docs WordPress plugin by VRPR, versions up through 1.2.4. Any WordPress site running one of these versions without additional patches is vulnerable.

The CVSS score of 6.5 classifies this as a medium‑severity issue, while the EPSS score of less than 1% indicates a very low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Attacks are most likely carried out via the plugin’s web interface or API endpoints, leveraging improperly configured access controls. An attacker would need to be authenticated with a low‑privilege account to exploit the flaw, unless the site permits unauthenticated access to the plugin’s features. The exploit requires no advanced privileges beyond basic user access and does not involve arbitrary code execution.