The vulnerability is a classic broken access control flaw that permits unauthenticated users to reach protected REST API endpoints within the WP REST Cache plugin. Because the plugin runs within WordPress, an attacker who can trigger these endpoints may retrieve cached content that should be behind authentication. The weakness is classified under CWE-862, indicating that the application fails to enforce necessary access restrictions, resulting in a high potential for data exposure or unauthorized control of the site.

The issue affects all installations of the Acato WP REST Cache plugin with versions 2026.3.1 or earlier. Users running these versions should verify their plugin version and update to 2026.4.0 or a later release to obtain the fix.

The CVSS score of 7.5 classifies this as a high severity vulnerability and suggests that exploitation would be straightforward once the attacker discovers the exposed REST endpoints. With no EPSS data, the exploitation probability is unknown, but the lack of a KEV listing means no known widespread exploitation has been reported yet. The likely attack vector is unauthenticated HTTP requests to the plugin’s REST API, which can be performed from any host via the public web interface.