The HivePress plugin suffers a missing authorization flaw that allows attackers to bypass intended access controls and potentially manipulate data or display content that should be restricted. This vulnerability arises from incorrectly configured security levels, enabling unauthorized actions that exceed the privileges of the current user.

The flaw impacts HivePress versions up to 1.8.1 inclusive, as used in WordPress installations that have not yet applied the 1.8.2 update. Any WordPress site running the affected HivePress plugin is vulnerable regardless of the WordPress core version.

With a CVSS score of 4.3, the flaw presents moderate risk, and its exploitation probability is currently unknown due to the absence of an EPSS score. The version is not listed in CISA’s KEV, suggesting no widespread exploit activity has been observed. The likely attack vector involves interacting with plugin configuration pages or endpoints that lack proper authorization checks, potentially accessible to unauthenticated or low‑privileged users.