The Booter – Bots & Crawlers Manager plugin for WordPress suffers from a broken access control flaw (CWE-862) that allows a victim to exploit incorrectly configured security levels. An attacker can gain unauthorized access to plugin functions, potentially reading or modifying protected data. No input validation or proper authorization checks are enforced, making the vulnerability straightforward to exploit once the target is located.

The issue affects the uPress Booter plugin, specifically all releases from the earliest available build through version 1.5.7. Users running WordPress sites with Booter <= 1.5.7 are at risk.

With a CVSS score of 8.8 this vulnerability is classified as high severity. The EPSS score is under 1%, indicating a very low probability of exploitation at present, and the vulnerability is currently not listed in CISA’s KEV catalog. The likely attack vector is remote, through unauthenticated HTTP requests to privileged plugin endpoints. Since the flaw is a pure authorization bypass, no special knowledge or privileges are required beyond the ability to reach the affected site.