The plugin contains a missing‑authorization vulnerability that lets attackers exploit incorrectly configured access control levels. This flaw, identified as a missing‑authorization weakness, can allow a user to perform actions normally reserved for higher‑privilege roles, such as editing or deleting content, modifying user capabilities, or accessing sensitive data, thereby compromising the confidentiality, integrity, and availability of the WordPress site.

WordPress installations using the PublishPress Authors plugin version 4.10.1 or earlier are affected. The issue spans all releases of the plugin from its earliest version through 4.10.1, regardless of the underlying WordPress version.

With a CVSS score of 7.5 the vulnerability is classified as high severity, while an EPSS score of less than 1% indicates current exploitation risk is low, although it could rise if the flaw becomes widely known. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation yet. Attackers most likely reach the vulnerable code via the WordPress web interface, where the plugin’s author or admin endpoints are exposed; if an unauthenticated or low‑privilege user can access these endpoints, the missing authorization can be abused to perform privileged actions.