The vulnerability is a missing authorization flaw in the E2Pdf e2pdf WordPress plugin. The CVE description indicates that the flaw allows exploitation of incorrectly configured access control security levels, leading to unauthorized operations within the plugin's functionality. The weakness is identified as CWE-862 (Missing Authorization).

All installations of the E2Pdf e2pdf WordPress plugin from the earliest released version through version 1.28.15 are impacted. This includes any site that has the plugin enabled regardless of WordPress user role or site size.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of public exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is a web-based request to the plugin’s endpoints, where an attacker could subvert access controls to perform unauthorized actions.