The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control settings in the VideoWhisper Site Manager for ChatGPT, Claude, Codex WordPress plugin. Exploitation can provide unauthorized users access to privileged operations within the plugin, potentially exposing sensitive data or enabling malicious configuration changes. The flaw is identified as CWE-862 and corresponds to a moderate severity level as reflected in the CVSS score.

The affected software is the VideoWhisper Site Manager for ChatGPT, Claude, Codex WordPress plugin, versions up to and including 1.2.10. All releases before 1.2.11 are vulnerable.

The CVSS score is 5.4, indicating moderate risk, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. If the plugin is exposed via a web interface, the likely attack vector is a remote web attacker sending crafted requests that bypass authentication checks. Successful exploitation requires that the plugin is active and the web server is accessible; no additional user privileges are required for initial access, but the plugin’s functionality may elevate the attacker’s capabilities.