The vulnerability is a missing authorization in the Designinvento DirectoryPress plugin, classified as a broken access control issue. Based on the description, it is inferred that an attacker that can reach the plugin’s web interface can exploit incorrectly configured access levels to bypass role checks and retrieve or manipulate protected data. The weakness is specifically identified as CWE‑862, and the CVSS score of 5.3 reflects a moderate potential impact on confidentiality and integrity for affected WordPress sites.

WordPress installations that have the Designinvento DirectoryPress plugin version 3.6.25 or earlier. The vulnerability applies to all users, regardless of role, that can interact with the plugin’s pages or API endpoints because no authorization is enforced.

With a CVSS score of 5.3 the vulnerability is considered moderate, while the EPSS score of less than 1 % indicates a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely leveraged in incidents. Based on the description, it is inferred that attackers would need network access to the WordPress site or the ability to authenticate as a user to send requests to the plugin’s restricted endpoints. It is also inferred that, once the missing authorization check is exploitable, attackers could read or modify plugin data, but would not be able to remotely execute code or gain full system control.