The vulnerability is a missing authorization flaw in the tstephenson WP-CORS WordPress plugin, allowing an attacker to exploit incorrectly configured access control levels. This flaw can let an unauthorized user view or modify protected resources exposed by the plugin, potentially leading to data disclosure or manipulation. As a CWE‑862 missing authorization issue, the primary impact is unauthorized access to content or configuration data.

Affected systems are WordPress sites that have the tstephenson WP-CORS plugin installed at version 0.2.2 or earlier. Any deployment of this plugin without an upgrade is vulnerable.

The CVSS score of 4.3 indicates low to moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so no confirmed public exploits are documented. Attackers would likely perform the exploitation remotely by sending crafted HTTP requests to the plugin’s endpoints; no local privilege escalation or execution is required.