A missing authorization check in the WPVulnerability plugin allows users that should not have privileges to view or change sensitive settings. This flaw permits an attacker to bypass normal access controls to the plugin’s configuration and potentially other protected resources, leading to unauthorized data exposure or modification. The weakness corresponds to a broken access control vulnerability classified as CWE‑862 and carries a moderate severity rating.

The affected product is the WPVulnerability plugin developed by Javier Casares for WordPress. All releases with a version number of 4.2.1 or earlier are vulnerable; versions newer than 4.2.1 are not documented as affected.

The CVSS score of 6.5 indicates a moderate risk, and the EPSS score of less than 1% suggests that large‑scale exploitation is currently unlikely. The flaw does not require any privileged state on the server; access can be achieved remotely by interacting with the plugin’s administrative endpoints, a conclusion inferred from the description of missing authorization. Although no public exploits are listed and the issue is not featured in CISA’s KEV catalog, the potential for unauthorized control warrants timely remediation.