The OpenStation WordPress plugin is vulnerable to an authorization bypass that allows any authenticated user with a “read” capability or higher to read private, draft, pending, or future post metadata and content, as well as unapproved and spam comment content and AI‑moderation results. The flaw originates from the plugin failing to verify that the requesting user is authorized to perform the action, effectively exposing sensitive information that should be restricted to higher‑privileged users.

All users running the OpenStation plugin version 1.1.7 or earlier on WordPress sites are affected. The vendor is All Terra in Developer, and the product is OpenStation, which provides Desktop Windows, Dock, and Virtual Desktops for WP Admin.

The vulnerability has a CVSS score of 4.3, indicating moderate risk. EPSS information is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting that zero‑day exploitation is not yet known. Based on the description, it is inferred that the attack requires authentication; any user with read access can enable the AI feature via the /openstation/ portal and then exploit the flaw using the /desktop‑mode/v1/os‑settings endpoint. Because the exploit path is straightforward for authenticated users, the likelihood of exploitation in environments where the plugin is out‑of‑date remains significant for affected sites.