The vulnerability is a missing authorization flaw that permits an attacker to exploit incorrectly configured access control security levels in WP Configurator Pro. Because the plugin does not enforce proper permissions, a malicious actor can potentially view, modify, or delete configuration data normally restricted to privileged users, thereby affecting data confidentiality and integrity of the WordPress site. The weakness is identified as a classic authorization bypass (CWE-862).

All installations of the WP Configurator Pro WordPress plugin with versions up to and including 3.7.9 are affected. The plugin is used within WordPress sites, so any site that has not upgraded beyond 3.7.9 is at risk.

The CVSS v3.1 score of 7.1 indicates a high severity level, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. The missing authorization control is most likely exploitable through remote web requests to the plugin's administrative endpoints, though the specific attack vector is inferred from the description rather than explicitly stated. The availability of the flaw across all affected versions means a single design oversight could enable widespread unauthorized access if an attacker targets a site that has not applied the recommended fix.