The vulnerability in the WordPress JAMstack Deployments plugin arises from an absence of proper authorization checks, allowing users to access or modify plugin features that should be restricted. This flaw can enable a non-administrative user to manipulate deployment settings, potentially exposing sensitive data or altering site behavior. The weakness is classified as CWE-862, reflecting improper authorization control.

Products affected are the WordPress JAMstack Deployments plugin from the vendor crgeary, version 1.1.1 and earlier. Any WordPress installation running this plugin is susceptible, regardless of other site configurations.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. The attack vector is likely through the plugin’s administrative interface, where an authenticated but unauthorized user could exploit the missing access controls. Successful exploitation would compromise confidentiality, integrity, or availability of deployment configurations within the affected WordPress site.