Technical impact
A missing authorization check in the CMSMasters Content Composer WordPress plugin allows attackers who can access the administration interface to perform actions that should be restricted to privileged users. The vulnerability is caused by an incorrectly configured access control security level, enabling users without proper permissions to manipulate content composer functionality and potentially alter site content or settings.
Affected Systems
The flaw affects the CMSMasters Content Composer plugin for WordPress on all versions from not applicable through version 2.5.8. Users of WordPress sites that have not upgraded the plugin beyond this version are vulnerable.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.1, indicating a high impact if exploited, while the EPSS score is less than 1% suggesting a low probability of exploitation at this time. It is not included in the CISA Known Exploited Vulnerabilities list, reducing the likelihood of a widespread targeted attack. The attack vector is most likely through the web interface; attackers need to authenticate to the WordPress admin area or leverage another authenticated session to access the vulnerable composer endpoints. The weakness is classified as CWE‑862, a missing authorization flaw.
