The vulnerability exists because the DT Directory Lite Addon does not implement nonce or capability checks on its settings handlers. Consequently, an unauthenticated attacker can send a request to the plugin’s configuration endpoints and alter the plugin’s settings and skin options. If the plugin’s configuration can influence script execution or other sensitive parameters, these changes could serve as a foothold for injecting malicious code, redirecting users, or configuring the site in a manner that facilitates additional exploits. The correct operation of the plugin relies on proper authorization, so the absence of these checks introduces a significant security weakness.

WordPress sites running the DT Directory Lite Addon version 1.1 or older are affected. The vulnerability applies to any installation of this plugin that has the default settings handlers exposed, regardless of other security controls present on the host WordPress instance.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the lack of authentication controls indicates a high potential impact. The attack vector is a simple unauthenticated HTTP request to the plugin’s settings endpoint, requiring only that the target site is reachable over the web. An attacker does not need any credentials or knowledge of site internals to exploit the flaw. Given the absence of mitigations in the plugin code, the exploitability is high, and the risk is significant for any site that retains this plugin in its vulnerable version.