The vulnerability is a missing authorization flaw in the Demo Importer Plus plugin for WordPress. It allows attackers to exploit incorrectly configured access controls, meaning that users may perform actions or access data that should require certain privileges. The defect aligns with CWE‑862, a broken access control weakness. No remote code execution or privilege escalation beyond the scope of the plugin’s functionality is documented.

Affected systems include installations running Kraft Plugins Demo Importer Plus version 2.0.8 or earlier. The plugin is a WordPress add‑on that facilitates importing demo content, and the flaw applies across all platforms where WordPress and the plugin are deployed as long as the vulnerable version is active.

The CVSS score is 4.3, indicating a moderate impact. The EPSS score is less than 1%, suggesting that exploit attempts are currently rare or unlikely. The vulnerability is not listed in CISA's KEV catalog. Attackers could potentially exploit the flaw remotely by accessing unprotected admin routes within WordPress, making the attack vector likely remote over the web. Successful exploitation would grant unauthorized users access to the plugin’s import capabilities and any data they can import, but there is no evidence of further privilege escalation outside the plugin’s scope.