A compromised WPO365 plugin version 44.1 or earlier allows an attacker to use broken subscriber access controls to elevate privileges or perform actions beyond their authorized scope. The vulnerability is classified as CWE‑862, indicating that authorization checks are insufficient, potentially granting unauthorized users access to sensitive features or data. The impact is the possibility of unauthorized data access or modification and escalation of privileges within the WordPress site.

The flaw affects the WordPress WPO365 plugin manufactured by Marco van Wieren. Any installations running version 44.1 or earlier are at risk. Updated releases start at version 45.0.

With a CVSS score of 8.5 the vulnerability is considered high severity. Exploitation would typically occur through the plugin’s web interface where the broken access control checks are performed. The EPSS score of < 1% indicates a low probability of exploitation, but the lack of a listing in CISA KEV does not reduce the risk. The violation allows an attacker with user-level permissions to gain broader access, and the attack path requires only knowledge of the plugin’s endpoints. Prompt remediation is advised to prevent privilege escalation and potential data breaches.