The WebP Conversion plugin for WordPress contains a missing authorization flaw that allows unauthorized users to trigger the plugin’s functionality. This broken access control can expose or modify content that the privileged user expected to protect. The vulnerability falls under the CWE-862 classification, illustrating improper validation of user permissions. As a result, attackers might modify images or the plugin configuration, potentially leading to data tampering or unauthorized information disclosure.

The issue affects the WordPress WebP Conversion plugin from the first release through version 2.2. Hosts running any of those versions are susceptible; newer releases are not impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests low immediate exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via HTTP requests that hit the plugin’s exposed endpoints, potentially by an unauthenticated or low‑privileged user. No special permissions or system configuration changes are necessary to exploit the flaw.