The Cnvrse plugin allows a user‑controlled key to be used in place of proper access controls, enabling an attacker to request the direct URL of protected objects without proper authorization. This Authorization Bypass Through User‑Controlled Key flaw can expose sensitive content or functionality that should be restricted, potentially exposing confidential data or system configuration to an attacker. The flaw is tied to CWE‑639 and manifests as an Insecure Direct Object Reference weakness.

WordPress installations that have the Cnvrse plugin version 026.02.10.20 or earlier are vulnerable. The CNA list identifies the product as "cnvrse" from version n/a through the mentioned release. No other vendors or products are listed, so the risk is limited to users running the affected plugin within WordPress sites.

The CVSS score of 7.5 indicates a high‑severity vulnerability, while the EPSS score of <1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is internal or authenticated, where a user can supply a crafted key or parameter to bypass access checks. An attacker with access to the affected WordPress dashboard or who can inject the key into requests could retrieve or manipulate objects that should be protected.