The Skydropx WordPress plugin contains a missing authorization flaw that lets attackers bypass the plugin’s access control settings. This omission allows unauthorized users to invoke functions and data that should be restricted, potentially giving them administrative privileges or exposing sensitive site information. The weakness maps to CWE‑862, which highlights incorrect or missing checks for user permissions.

All installations of the Skydropx plugin version 2.1.4 and older are affected. The problem is present in every build before the fixed 2.1.5 release. WordPress sites that have opted for these versions are therefore susceptible.

The CVSS score of 8.2 marks the vulnerability as high severity. The EPSS score is not available, but the lack of any listed exploitation for the same CVE in the KEV catalog suggests that a widespread, currently known exploit is not documented. Based on the description, exploitation likely requires interacting with the plugin’s public endpoints, meaning that an attacker who can submit requests to the WordPress site may be able to trigger the flaw. The impact is limited to the scope of the accessed plugin functions, but can result in privilege escalation or data exposure if the plugin handles sensitive data.