Technical impact
The vulnerability is a missing authorization flaw that permits exploitation of incorrectly configured access control security levels. The primary consequence is that an attacker can gain elevated privileges within the Responsive Posts Carousel Pro plugin, potentially modifying or deleting carousel content or configuration. This flaw falls under the CWE-862 category, which denotes an authority-control weakness.
Affected Systems
The affected product is the WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress, with vulnerability ranging from an unspecified initial version through version 15.1. No specific full CPE strings are provided, so the impact is limited to WordPress sites that have installed any version of the plugin up to and including 15.1.
Risk and Exploitability
The CVSS score of 7.5 indicates a high-severity vulnerability, but the EPSS score is listed as less than 1% and the flaw is not featured in the CISA KEV catalog, suggesting low exploitation probability in the wild. The likely attack vector is remote, via the WordPress web interface, potentially requiring an authenticated user with insufficient privileges or a misconfigured role. Only a user that can navigate the plugin’s administrative panel could exploit the missing authorization checks to alter plugin data or settings.
