The vulnerability is a missing authorization flaw that allows an attacker to bypass the intended access controls in the Speed Kit plugin for WordPress. The flaw stems from incorrectly configured security levels, enabling an attacker to reach endpoints or configuration interfaces that should be restricted to privileged users. This vulnerability is classified as CWE-862, indicating a failure to enforce access control restrictions.

All installations of the baqend Speed Kit plugin for WordPress from the earliest available version through version 2.0.2 are affected. The impact applies regardless of the site’s user base, meaning any site that has installed the plugin without updating to a newer release is at risk.

The EPSS score is below 1 percent, and the vulnerability has not been listed in CISA KEV, suggesting that current exploitation activity is low but not impossible. The attack likely requires the ability to send crafted requests to the vulnerable plugin endpoints, and the exact prerequisite authentication state is not explicitly documented, which implies that the flaw may be exploitable from unauthenticated or minimally privileged contexts. Attackers could gain unauthorized access to configuration information or administrative controls, potentially leading to further compromises of the WordPress site.