This vulnerability is a broken access control issue that allows an attacker to exploit incorrectly configured security levels within the WordPress WP Terms Popup plugin. Missing authorization checks enable unauthorized users to access and potentially modify plugin or site data that should be restricted, leading to unauthorized changes or disclosure.

The affected software is the WP Terms Popup plugin from Link Software LLC. All versions from initial release up to and including 2.10.0 are impacted. Users running WordPress sites with these plugin versions are at risk.

The CVSS score of 7.5 highlights significant potential impact, while the EPSS score of less than 1% indicates low current exploit prevalence. The vulnerability is not listed in CISA’s KEV catalog. Inferred from the description, the attack vector is likely the web interface, where unauthenticated or low‑privileged users could access plugin endpoints that lack proper authorization checks. Exploitation would require a user to identify these endpoints and send crafted requests, potentially elevating privileges or modifying site content.