The vulnerability arises from a missing authorization check that allows incorrectly configured access control. A user who can access the Spectra plugin’s administrative interfaces could potentially modify plugin settings or other site data, leading to unauthorized changes. The weakness is a classic missing authorization flaw (CWE-862) and could be used to alter content or otherwise compromise the site’s configuration.

WordPress installations that run the Brainstorm Force Spectra plugin – any version from the earliest release up through 2.19.17 – are affected. Sites that have not updated this plugin beyond version 2.19.17 remain vulnerable.

The CVSS score of 5.3 places the issue in the medium severity range. EPSS indicates an exploitation probability of less than 1%, showing a low likelihood of being targeted. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed. The likely attack vector would involve an attacker accessing the plugin’s administrative endpoints; the ability to do so depends on the site’s current user privileges and any existing authentication mechanisms. Overall, while the risk is moderate, the impact of a successful exploit could allow unauthenticated or low-privilege users to alter plugin and potentially site settings.