The vulnerability arises from a missing authorization check in the Cloudinary WordPress plugin. Because the plugin does not verify a user’s permissions when handling certain requests, an attacker can access or manipulate media that should be restricted. This flaw falls under the CWE-862 "Missing Authorization" weakness. The result is that an unauthorized user with access to the WordPress site can potentially view or modify protected content, compromising confidentiality and integrity of media assets.

The affected product is the Cloudinary WordPress plugin, version 3.3.2 or earlier. No specific configurations are enumerated beyond the version constraint; the plugin is listed as Cloudinary:Cloudinary in the CNA data.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% points to a very low probability of exploitation at the time of analysis, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack path requires access to the WordPress installation’s web interface or the ability to send crafted HTTP requests to the plugin’s endpoints. Because the flaw is a missing authorization check rather than an injection or code execution vector, the impact is largely limited to unauthorized data access rather than system compromise.