The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels in the Ave Core plugin. Because the plugin’s administrative functions are not properly protected, an attacker could gain unauthorized access to protected configuration settings or other sensitive functionality provided by the plugin, potentially enabling further misuse of the WordPress site.

All installations of the Ave Core plugin from the first released version through version 2.9.1 are affected. Site administrators who use this plugin on WordPress should identify whether those specific plugin versions are in use and ensure that the plugin is updated or removed.

The CVSS score of 6.3 places this vulnerability in the medium severity range, and the EPSS score of less than 1% together with the absence from the CISA KEV catalog indicate that the likelihood of active exploitation is currently low. Nevertheless, the flaw can be leveraged by users with limited site privileges to access privileged plugin pages, which may lead to unauthorized configuration changes or disclosure of protected data. Attackers would likely traverse the plugin’s administrative interface; however, detailed exploitation steps are not supplied in the description, so the risk assessment is based on the nature of the broken access control.