This vulnerability is a missing authorization flaw that permits users with incorrectly configured access control settings to exploit the InstaWP Connect plugin. The issue can let an attacker gain unauthorized access to protected plugin features or perform actions beyond their intended scope, thereby compromising integrity and potentially confidentiality of the WordPress site. The weakness is grouped under CWE-862, reflecting improper authorization controls.

WordPress installations running the InstaWP Connect plugin version 0.1.2.5 or earlier are affected. The issue originates from the InstaWP vendor's component and applies to any site that has the plugin installed without a newer patch.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1%, which suggests that exploitation likelihood is currently low and the vulnerability is not reported in CISA’s KEV catalog. The most probable attack vector is remote, arising through the plugin’s administrative interface, as the flaw stems from misconfigured access controls. No direct exploitation code or publicly available exploit is documented, but the underlying weakness could be leveraged if an attacker can manipulate the plugin’s configuration or target an unauthenticated user session.