The vulnerability stems from missing authorization checks in the weDevs WP ERP plugin, classified as CWE-862. These gaps allow users with insufficient privileges to access privileged administrative functions, leading to potential alteration or disclosure of sensitive business data. Based on the description, it is inferred that an attacker could exploit the plugin’s exposed endpoints either through a normal user session or, if any endpoint is public, via unauthenticated requests.

WordPress installations running the weDevs WP ERP plugin version 1.17.10 or earlier are affected. The flaw applies to all sites where the plugin is present and configured as described, regardless of other security controls.

The CVSS score of 4.3 indicates a moderate risk level. EPSS is not available, so the probability of exploitation is uncertain, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed large-scale attacks. Nonetheless, because the flaw permits unauthorized access to administrative capabilities, it poses a moderate threat, especially in environments with weak user role restrictions or default credentials. An attacker would need access to the WordPress site, either through an existing account or by compromising a user session.