The vulnerability is a missing authorization flaw in the WordPress WPCafe plugin that allows exploitation of incorrectly configured access control levels. An attacker can use this flaw to access functions or data that should be restricted, potentially gaining privileged actions or exposing sensitive information. The flaw is classified as CWE‑862, missing authorization, and can lead to serious confidentiality and integrity breaches if exploited.

The affected product is the WordPress WPCafe plugin made by Arraytics. All versions from the first release up to and including 3.0.7 are vulnerable. Site administrators should confirm whether their installations fall within this range and take corrective action.

The CVSS score of 9.1 indicates a high severity risk. However, the EPSS score is less than 1%, suggesting that current exploitation activity is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve an authenticated user or an attacker with some form of access to the WordPress dashboard interacting with the plugin’s endpoints. Proper monitoring for anomalous activity is recommended due to the potential for privilege escalation.