Technical impact
The vulnerability is a missing authorization flaw that allows users to bypass intended security levels by incorrectly configuring access controls. Because the plugin does not enforce proper privileges, an attacker could potentially perform any action normally restricted to administrators, such as viewing or modifying sensitive content, executing plugin functions, or altering configuration settings. The weakness is classified as CWE‑862: Authorization Bypass Through Privileged Credentials, indicating that the problem lies in insufficient enforcement of user roles and permissions.
Affected Systems
The affected products are the MiKa OSM plugin for WordPress, in all releases from the initial version through version 6.1.12 inclusive. Any WordPress site deploying one of these plugin versions is potentially impacted. Users who have not upgraded beyond 6.1.12 are therefore exposed to the risk.
Risk and Exploitability
The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented active exploitation. The likely attack vector is via the plugin interface, where an attacker with or without legitimate access could exploit insecure configuration settings to elevate privileges or execute unauthorized operations. Proper configuration or patching is required to mitigate this risk.
