The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin contains an insufficient capability check in the function 'stopbadbots_check_wordpress_logged_in_cookie'. This flaw lets unauthenticated users trigger the plugin’s filtering logic, enabling them to bypass configured blocklists, rate limits, and other anti‑spam mechanisms. The vulnerability is an authorization bypass weakness (CWE‑863) and does not provide arbitrary code execution or higher privileges.

Any WordPress installation that has the Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin version 11.58 or earlier is affected. The description indicates that later releases may not yet address the issue, so administrators should verify the current plugin version against the vendor’s update notes.

The CVSS score of 6.5 classifies the flaw as moderate severity, while the EPSS score of < 1 % suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves sending crafted HTTP requests to the plugin’s endpoints that invoke the vulnerable function; no authenticated role is required. Because the flaw erodes core anti‑spam protections, it should be remediated promptly.