The RSS Feed Widget plugin for WordPress contains a missing authorization flaw that results in broken access control for versions up to and including 3.0.2. This issue originates from incorrectly configured access control security levels, identified as CWE‑862. The plugin’s functionality can be accessed without proper authentication, potentially exposing the plugin’s endpoints and content to unauthenticated users. The description does not specify whether read, modify, or delete operations are possible, but the missing authorization indicates that some level of unauthorized interaction can occur.

The affected product is the WordPress RSS Feed Widget plugin developed by Fahad Mahmood. Versions from the initial release to 3.0.2 are vulnerable; no fixed version is mentioned in the provided data.

The calculated CVSS score of 5.4 reflects a moderate severity for this missing authorization flaw. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the website’s web interface, where an unauthenticated user could target the plugin’s endpoints to access data protected by the broken access control.