The vulnerability is a missing authorization flaw in Ex-Themes WP Food that allows an attacker to exploit incorrectly configured access control security levels. The issue can be classified under CWE-862 and results in unauthorized access to plugin features or data, potentially enabling data disclosure or modification.

All installations of the WP Food plugin from the earliest releases up to, but not including, version 2.7.1 are affected.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation currently. The vulnerability has not been listed in the CISA KEV catalog. Given that it is a broken access control flaw, an attacker would likely need authenticated access to the WordPress site's backend or the plugin's interface, but no special privileges are required beyond that. Because the exploit path is straightforward and the EPSS is low, the overall risk is considered moderate, yet administrators should still remediate promptly.