The vulnerability is an unauthenticated broken access control flaw in WordPress picu plugin versions up to and including 3.10.1. An attacker without credentials can exploit the flaw by accessing resources or performing actions that should be restricted, potentially altering content, data, or configuration through the plugin interface. The weakness maps directly to CWE-862, indicating that the system fails to enforce proper permission checks.

WordPress sites using the picu plugin with a version of 3.10.1 or older are affected. The affected vendor/product is picu:picu, and the fix starts with version 3.10.2.

The CVSS score of 7.3 indicates a high severity risk. The EPSS score of < 1% indicates a very low probability of current exploitation. The vulnerability is not listed in CISA KEV, but the lack of a public exploit does not eliminate risk; an attacker could feasibly use the access control bypass to gain elevated privileges within the affected WordPress installation.