The Hospital Doctor Directory plugin contains a missing authorization flaw that lets attackers bypass intended access restrictions on the plugin’s administrative and data‑exposure features. As a result, an attacker could read, modify, or delete sensitive information stored by the plugin, or potentially execute actions reserved for higher‑privileged users. The weakness is characterized as CWE-862 and is labeled a high‑severity vulnerability.

All installations of the e‑plugins Hospital Doctor Directory plugin up to and including version 1.3.9 are impacted. The issue exists in every release from the initial version through 1.3.9, so any site running the plugin in this range is vulnerable.

The CVSS score of 7.3 indicates a high impact, while the EPSS score of less than 1 % suggests the likelihood of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would likely exploit the flaw via the plugin’s web interface, potentially by accessing unauthorized endpoints after authenticating as a user with limited privileges. Precise exploitation requires correctly configured access controls within the plugin, so the attack vector may be either authenticated or unauthenticated, depending on the site’s configuration.