The vulnerability in the Wheel of Life WordPress plugin stems from a missing authorization check, allowing users to trigger privileged functions without proper verification. This flaw leads to an authorization bypass, enabling attackers to elevate privileges within the plugin, potentially exposing sensitive configuration or manipulating plugin data. The weakness is classified as CWE‑862, reflecting a failure to enforce adequate access control.

WordPress sites that have installed Kraft Plugins Wheel of Life version 1.2.0 or earlier are impacted. The vulnerability does not affect newer releases beyond 1.2.0, but any site still running the affected plugin version remains at risk.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS value of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Because the flaw requires access to a request that is not properly authorized, the attack vector is likely local to users who can reach the plugin’s administration interface, however the exact prerequisites are not fully detailed in the available description.