A missing authorization condition in the Really Simple SSL plugin version 9.5.7 and earlier allows an attacker to exploit incorrectly configured access control security levels. The vulnerability is a classic broken access control flaw (CWE-862) that can give unauthorized access to sensitive plugin settings, potentially compromising site configuration or other protected data.

The affected product is the Really Simple SSL plugin from Really Simple Plugins. All releases from the initial public release up to and including version 9.5.7 are vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but the lack of a specific attack vector in the documents leads to the inference that the exploit most likely occurs through the plugin’s administrative web interface or exposed HTTP endpoints. An attacker would need to craft requests that bypass normal access checks to manipulate plugin settings or extract sensitive information.