The vulnerability is a missing authorization flaw in the CloudPanel CLP Varnish Cache WordPress plugin. It allows an attacker to perform unauthorized actions that should be restricted—through the plugin’s administrative interface. The weakness is classified as Broken Access Control (CWE‑862) and can compromise the confidentiality and integrity of the site’s caching configuration.

WordPress sites that have the CLP Varnish Cache plugin from CloudPanel with a version of 1.0.2 or earlier are affected. The vulnerability applies to any release up to and including 1.0.2, as the product description lists "from n/a through <= 1.0.2."

The CVSS v3.1 score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, where an attacker can reach the plugin’s admin pages to exploit the broken access control, but this is an inference because the CVE description does not explicitly state the vector.