Missing Authorization in Horea Radu Materialis Companion allows an attacker to bypass the plugin’s intended access controls, potentially exposing functions that should be limited to privileged users. The weakness is classified as CWE‑862, leading to unauthorized modification or viewing of plugin configuration and content. This can compromise site integrity and confidentiality without requiring elevated privileges at the system level.

The vulnerability affects WordPress sites that use the Materialis Companion plugin by Horea Radu, specifically all releases up to and including version 1.3.52. No minimum version is stated, so any earlier releases are also potentially vulnerable until patched.

The CVSS base score of 4.3 indicates moderate risk, and the EPSS score of less than 1 % shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability at present. Attackers could reach the exposed functionality through normal authenticated requests once logged in as any user, leveraging the insufficient authorization checks. The implication is that a compromised or unauthenticated account with basic WordPress login can manipulate plugin settings.