The WP Connect WP Sync for Notion plugin contains a missing authorization flaw that allows visitors or users with minimal privileges to interact with protected plugin features. By bypassing the intended access controls, an attacker could potentially add, edit, or delete content synchronized between WordPress and Notion, or expose sensitive configuration information. The weak point is a classic input or access control problem identified as CWE-862.

Vendors affected include WP connect and the WordPress plugin WP Sync for Notion. All plugin versions up to and including 1.7.0 are vulnerable; any WordPress site running these versions is at risk.

This vulnerability receives a CVSS score of 4.3, indicating a moderate impact, and an EPSS score of less than 1%, suggesting a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to have some level of site access or to be able to trigger plugin actions, so the likely attack vector is local or authenticated via the WordPress admin interface. While the risk is currently low, any site that could expose the plugin’s management URLs or allow unauthenticated users elevated privileges remains a potential target.