The vulnerability arises from a missing authorization check in the Autoshare for Twitter plugin, allowing an attacker to bypass normal role‑based controls. The flaw is classified as a broken access control weakness (CWE‑862). Without proper authentication enforcement, an attacker could potentially manipulate tweet schedules, edit settings, or perform other privileged actions. This puts the confidentiality and integrity of the site’s social media configuration at risk.

The weakness affects the 10up Autoshare for Twitter WordPress plugin for all installed versions up to and including 2.3.1. Any site running a vulnerable version of this plugin is susceptible.

The Common Vulnerability Scoring System assigns a CVSS score of 5.4, indicating moderate severity. The Exploit Prediction Severity Score is below 1 %, showing a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would need to interact with the WordPress site’s plugin administration interface and likely benefit from a user with limited privileges or an unauthenticated vulnerable endpoint; the exact attack vector is inferred from the description of a missing authorization check.