The vulnerability in the Advanced Post Manager plugin is a missing authorization flaw that allows attackers to bypass the plugin’s intended access control levels. Exploiting this flaw can let an unauthenticated or low-privilege user view, modify, delete, or create posts and other content that should be restricted, compromising the confidentiality, integrity, and availability of site data.

Affected systems are WordPress installations that have the Advanced Post Manager plugin from Liquid Web or StellarWP at or below version 4.5.6. The plugin can be found on sites that use WordPress as their CMS, and the vulnerability applies to all releases from the earliest available version up through 4.5.6 inclusive.

The CVSS score of 7.1 indicates a high severity of risk. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the current exploitation probability is unknown but it could be taken seriously, especially on sites with exposed or poorly protected administration endpoints. The likely attack vector is through normal web requests to the WordPress site, as the plugin operates inside the CMS. Attackers would need to perform a request to the plugin’s page or an unprotected endpoint, then manipulate role or permission checks to gain elevated capabilities.