The vulnerability is a missing authorization flaw that enables attackers to bypass the configured access control levels in the WPMasterToolkit plugin. An attacker who can interact with the plugin’s privileged endpoints can potentially access, modify, or delete data handled by the plugin, leading to confidentiality and integrity risks. The weakness aligns with CWE-862, which focuses on inadequate protection of privileged actions.

The affected product is the WPMasterToolkit plugin by Ludwig You, version 2.14.0 and earlier. All installations using these versions are at risk. WordPress sites that have the plugin installed and have not applied a newer version should verify their deployment.

The CVSS score of 4.3 indicates a low to moderate severity; the EPSS score is below 1%, implying a low probability of public exploitation at present. It is not listed in the CISA KEV catalog. Exploitation likely requires the attacker to send crafted requests to the plugin’s administrative endpoints; authentication status is unclear but the issue suggests that proper authorization checks are missing, potentially allowing unauthenticated or low‑privilege users to perform privileged actions. In the absence of a public exploit, the risk remains low but it should be treated as a potential threat.