Institutions Directory plugin suffers from a missing authorization check that lets a user perform actions beyond their intended privileges. The flaw, identified as CWE‑862, permits unauthorized access to restricted parts of the plugin’s interface, potentially exposing sensitive data or enabling modification of plugin-managed records. Because it is a client‑facing component, the impact is confined to users interacting with the WordPress site but can undermine data confidentiality and integrity if exploited.

The vulnerability affects the WordPress Institutions Directory plugin from e‑plugins, in all releases through and including version 1.3.4. WordPress site administrators using this plugin are exposed until a newer, patched release is installed. Versions older than 1.3.4 are also affected, as the issue applies to the entire range of affected releases.

The CVSS score of 7.3 indicates a high impact if the flaw is leveraged, but the EPSS score of less than 1% shows a very low likelihood of active exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require access to the web interface of the affected site, most likely through authenticated requests; a remote attacker with valid user credentials could gain elevated access by interacting with the plugin’s administration pages.