The WP Wallcreeper WordPress plugin contains a missing capability check on the admin_notices hook in all releases up to and including 1.6.1. This flaw, identified as CWE‑862 (Missing Authorization), permits any authenticated user with Subscriber-level access or higher to enable or disable the plugin's caching feature, thereby altering site behavior without proper authorization. The vulnerability does not expose remote code execution or direct data exfiltration but enables an attacker to tamper with site performance and potentially disrupt content delivery.

WordPress installations that use the WP Wallcreeper plugin, versions 1.6.1 and all earlier releases. Any site that has the plugin activated and an authenticated user with Subscriber or higher privileges is at risk.

The CVSS score of 4.3 reflects a moderate impact for authorized users, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires only that the attacker is logged into the WordPress admin area; no additional vulnerabilities or elevated privileges are needed beyond the standard role permissions. The attack vector is the web application through the admin_notices hook, inferred from the description.