The plugin fails to verify that a user is authorized to modify placement records. An authenticated attacker with a subscriber role or higher can alter the position, sort order, parent folder, and metadata of any other user’s placement entries. In addition, the attacker can read serialized metadata—including titles, permalinks, and post status—from entities referenced by orphaned placements. This results in both integrity violations of UI arrangements and confidentiality exposure of content references.

WordPress sites running the OpenStation “Desktop Windows, Dock & Virtual Desktops for WP Admin” plugin, versions up to and including 1.1.16. The vulnerability exists in all supported installations of the plugin for any WordPress site that has enabled the OpenStation feature.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified, but the conditions required—an orphaned placement and access to the save-openstation AJAX endpoint—are produced automatically by the plugin’s trash cascade and are trivial for any user with the default ‘read’ capability. All default WordPress roles possess this capability, which means that every subscriber and higher will be able to exploit the flaw as soon as they are logged in. Although the vulnerability is not listed in the CISA KEV catalog, the wide distribution of the plugin and the low barrier to exploitation raise the practical risk to affected sites.