The vulnerability is a missing authorization flaw that permits unauthorized users to access protected data handled by ABCdatos Protección de datos – RGPD. This issue arises from incorrectly configured access control security levels, allowing exploitation without proper role validation. The flaw could expose personal information, potentially breaching GDPR obligations. It is categorized as CWE‑862 Incorrect Authorization.

WordPress sites that use the ABCdatos Protección de datos – RGPD plugin, version 0.68 or earlier. No other vendors or products are specifically mentioned as affected.

The reported CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through web interfaces or plugin endpoints that lack proper permission checks, requiring authentication but not validating the actor’s role. Successful exploitation would grant access to data protected by the plugin, potentially revealing personal information.