The Pochipp plugin for WordPress contains a missing authorization vulnerability that allows attackers to exploit incorrectly configured access control security levels. This flaw is identified as CWE-862 and can enable an attacker to perform actions or access data that should be protected by the plugin’s intended access controls. The potential impact includes unauthorized viewing or modification of plugin data, configuration settings, or actions that the plugin permits to authenticated users.

The vulnerability affects all versions of the Pochipp plugin older than 1.18.9 on WordPress sites. Any WordPress installation that has a Pochipp plugin version from the earliest available up to 1.18.8 is potentially impacted.

The CVSS score for this issue is 5.4, indicating moderate severity. The EPSS score is reported to be less than 1%, suggesting a relatively low likelihood of exploitation in the wild. The vulnerability has not been listed in the CISA KEV catalog. The attack vector is not explicitly described in the vendor data, but based on the description it is inferred that the flaw can be triggered via the WordPress web interface where the plugin’s functionality is accessible.