The vulnerability is a missing authorization flaw that allows attackers to bypass access control checks in the Geo Mashup plugin. The flaw permits unauthenticated users to reach functions or data that should be restricted, potentially exposing sensitive geographic information or other plugin content. This weakness is an example of CWE-862, which denotes inadequate authorization controls.

The issue affects the WordPress Geo Mashup plugin provided by Dylan Kuhn, specifically all releases from the unknown initial version up to and including version 1.13.22. The vulnerability applies to any WordPress installation that has this plugin installed and does not have additional custom access restrictions.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, suggesting no publicly reported exploitation trends. The likely attack vector is through web requests to the plugin’s endpoints that expect authenticated access; a remote attacker could craft requests to exploit the missing authorization checks, assuming the target site exposes the plugin APIs.