The vulnerability is an unauthenticated broken access control flaw (CWE-862) that permits an attacker to invoke protected functions of the HUSKY plugin. The flaw could allow remote modification of plugin settings or the execution of privileged operations without a valid user session, potentially leading to data exposure or compromise of the WordPress site.

The affected product is the HUSKY WordPress plugin, version 1.4.6 and all earlier releases, developed by RealMag777. Users of these plugin versions are at risk until an upgrade to 1.4.7 or later is performed.

The entry has a CVSS score of 7.5, indicating high severity. EPSS data is not available, and the vulnerability has not been listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be via direct HTTP requests to plugin endpoints that do not require authentication, enabling a remote attacker to exploit the access‑control weakness without elevated privileges.