The vulnerability stems from a missing authorization check within the WP MapIt plugin, which allows an attacker to exploit incorrectly configured access control levels. This flaw can enable unauthorized users to access or manipulate features that should be restricted, potentially exposing sensitive map data or permitting unwanted modifications. The weakness is a classic example of broken access control (CWE‑862), leading directly to privilege escalation within the WordPress environment.

The affected product is the WordPress plugin WP MapIt developed by Chandni Patel. Any installation of WP MapIt version 3.0.3 or earlier is vulnerable. The vulnerability is present across all WordPress sites that have this plugin enabled, regardless of other security configurations.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no known exploits have been publicly reported. Based on the description, the likely attack vector is through the plugin's web interfaces, where an attacker could issue HTTP requests to restricted endpoints without proper authorization checks. While the data indicates missing authorization, detailed exploitation conditions are not explicitly disclosed, so it is inferred that any user who can send requests to the plugin may attempt to elevate their privileges.