The vulnerability is a missing authorization flaw in the Ays Pro Advanced Related Posts WordPress plugin. The official description states that the flaw allows exploitation of incorrectly configured access control security levels, permitting an attacker to bypass expected permission checks and potentially access or modify the plugin’s configuration settings. The weakness is identified as CWE‑862: Missing Authorization.

The affected product is the Ays Pro Advanced Related Posts plugin for WordPress. All releases from the earliest available version up through version 1.9.1 are vulnerable. Any WordPress site that has this plugin in that range is susceptible to the flaw.

The CVSS score of 5.3 indicates moderate severity while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be through requests to the plugin’s configuration endpoints or the admin interface, though the official description does not specify the precise path. Exploitation requires reaching a location where the missing authorization check applies, which may involve authenticated or unauthenticated requests depending on the site’s configuration.