The vulnerability is an authorization bypass in the iNET Webkit WordPress plugin, allowing attackers to gain access to resources they should not see or control. The weakness arises from improper validation of user permissions, categorized as CWE-862. Consequently, an attacker could read or modify sensitive data, alter plugin settings, and potentially inject malicious content into the WordPress site. The impact threatens confidentiality and integrity of site data, and could provide a foothold for further exploitation.

WordPress installations that use the iNET Webkit plugin, versions up to and including 1.2.4. All deployments of this plugin are considered vulnerable, irrespective of site size or user configuration.

The CVSS score of 6.5 indicates a medium severity risk, while the EPSS score of under 1% denotes a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit the flaw over HTTP by sending requests to plugin endpoints that lack proper role checks; the likely attack vector is inferred from the description. No additional prerequisites beyond legitimate WordPress credentials are explicitly listed, making the condition relatively easy to satisfy for any authenticated user.