The YMC Filter & Grids plugin for WordPress contains a Missing Authorization flaw (CWE-862) that allows an attacker to bypass normal access controls and perform unauthorized operations on plugin data (CVE description). This flaw can enable reading, modifying, or deleting content managed by the plugin, thereby compromising confidentiality and integrity of the site’s data (CVE description).

All installations of YMC Filter & Grids (ymc‑smart‑filter) with versions up to and including 3.5.1 are vulnerable as the issue exists from the earliest release through 3.5.1 (CVE description). No fixed version is listed in the CNA data, so the exact affected versions are not explicitly enumerated (KNAWB .)

The CVSS score is 5.3, indicating medium severity, and the EPSS score is <1%, showing a low current likelihood of exploitation (SCORES). The vulnerability is not listed in the CISA KEV catalog (SCORES). As no publicly documented exploit is known, the attack vector is inferred to be a misconfiguration or an attacker who can influence plugin access‑control settings (inference from CVE description). The risk is therefore theoretical unless the site is misconfigured.