The vulnerability is an unauthenticated broken access control flaw in WordPress Ditty plugin versions 3.1.66 and earlier. It permits an attacker to bypass built‑in authentication checks and acquire administrative privileges that the website owner should not allow to unauthenticated users. This flaw is mapped to CWE‑862 and enables operation on the plugin’s admin interface that should be restricted.

WordPress sites that have the Ditty plugin installed at version 3.1.66 or older are affected. Any site that serves the plugin’s admin URLs over HTTP or HTTPS can potentially be compromised if the broken access control is present.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation under typical conditions. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web interface, assuming the attacker can reach the plugin’s administrative URLs; the flaw does not require prior authentication. Attackers could use this access to modify or delete ticker content, change plugin configuration, or potentially access other sensitive endpoints exposed by the plugin.