The WP Business Intelligence Lite plugin for WordPress contains a missing authorization check that allows any authenticated user with Subscriber level access or higher to modify stored SQL queries. Based on the description, the likely attack vector is an authenticated subscriber modifying stored SQL queries through the plugin’s admin interface, which are later executed when an administrator views them, enabling arbitrary SQL execution. The flaw is a classic Missing Authorization vulnerability (CWE-862), leading to privilege escalation, data compromise, and potential full database control.

This issue affects installations of the WP Business Intelligence Lite plugin from Joey Youngblood on WordPress sites running version 3.2.0 or earlier. All users who can install or activate the plugin, or who have Subscriber or higher roles, are potentially impacted until an update is applied.

The CVSS score of 8.0 indicates a high severity level. An EPSS score of <1% (0.00348) indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been documented as of now. However, the attack can be performed by any authenticated subscriber via the plugin’s administrative interface, making it relatively straightforward once access is obtained. Based on the description, it is inferred that once a subscriber modifies a stored query, the query is executed when an administrator views it, enabling arbitrary SQL execution and privilege escalation.