The vulnerability in the Amauri.IO WPMobile.App WordPress plugin allows an attacker to bypass authorization checks, enabling unauthorized access to protected resources. An attacker can exploit incorrectly configured access control security levels to gain read or write privileges for settings, user data, or report generation features. This weakness is identified as CWE-862, which can lead to compromise of confidentiality, integrity, or availability of the site’s data and functionality.

Affected products include the WPMobile.App plugin by Amauri.IO. All versions from the initial release through version 11.86 are vulnerable. The plugin integrates with WordPress sites that expose mobile app functionality via wpappninja endpoints.

The CVSS score of 7.5 indicates high severity. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector would involve accessing exposed plugin endpoints over the network, exploiting the broken authorization without requiring elevated privileges. While exploit availability is not confirmed, the impact would be significant if an attacker can manipulate app settings or access sensitive data.