The vulnerability resides in the My WP Translate plugin for WordPress, where certain functions bypass the required capability check, allowing any user with Subscriber privileges or higher to manipulate site options. By executing the malicious actions, an attacker can read configuration values or delete arbitrary options, potentially rendering the site unstable or unavailable. This flaw aligns with the CWE-862 classification of Missing Authorization.

The flaw is present in all releases of My WP Translate from the initial version through 1.1, distributed by My Theme Shop. WordPress sites running any of these versions are susceptible. No specific WordPress core or PHP version requirements were noted, so the affected environment is any WordPress installation that hosts the plugin.

The CVSS score of 5.4 indicates a moderate threat, while the EPSS score of less than 1% signifies that exploitation is unlikely in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Attackers must be authenticated with a Subscriber role or higher, after which they can issue requests to the plugin's admin actions to read or delete options, thereby causing integrity or availability issues.