The vulnerability arises because the WebPurify Profanity Filter plugin fails to verify user capabilities before executing its settings‐update function. The lack of a capability check allows anyone who can submit a request to the "webpurify_save_options" endpoint to alter configuration options. Based on the description, it is inferred that the attack vector is an unauthenticated HTTP request to this endpoint, which can enable or disable the profanity filter, change block thresholds, or inject malicious settings, effectively bypassing content moderation. This flaw is a classic missing authorization issue, classified under CWE-862.

All releases of the WordPress plugin WebPurify Profanity Filter up to and including version 4.0.2 are affected. No other products are listed as impacted.

The severity rating of 6.5 on the CVSS scale indicates a moderate risk, but the EPSS value of less than 1% suggests that real‑world exploitation is rare as of the latest data. The vulnerability is not yet present in the CISA KEV catalog, meaning it has not been reported as a widely observed exploit. Based on the description, it is inferred that an attacker can trigger it with an unauthenticated HTTP request to the option‑saving handler; no local access is required, and the window of opportunity is open as long as the old version remains in place.