Missing authorization controls in the Trusona for WordPress plugin enable unauthorized users to execute administrative actions within the plugin. The flaw arises from incorrectly configured access control security levels, potentially allowing attackers to manipulate data or privilege state associated with the plugin's functionality. The impact is confined to the plugin’s scope rather than the host WordPress installation as a whole, but can still aid in further attacks if the plugin interfaces interact with core systems.

The vulnerability affects all installations of Trusona for WordPress through version 2.0.0. No specific sub-versions are listed; any instance running any version up to and including 2.0.0 is considered vulnerable.

The CVSS score of 4.3 indicates a moderate risk level. The EPSS score of less than 1% suggests a low probability of exploit in the wild, and the vulnerability is not catalogued by CISA. It is likely that exploitation requires access to the plugin’s web interfaces; users who can trigger the affected endpoints can bypass the intended access restrictions. A remote attacker could use the exposed functionality to elevate privileges within the plugin context. Because no exploit public code is listed, the risk remains limited but should still be remedied promptly.