The vulnerability is a missing authorization flaw in the wpWax Directorist plugin that allows attackers to access functionality or resources that should be restricted. This flaw stems from incorrectly configured access control security settings, giving unauthorized users the ability to read or manipulate data meant for authorized users only. The weakness is a classic missing authorized access control issue and can lead to unauthorized disclosure, modification, or denial of sensitive content within the WordPress site.

The flaw affects the wpWax Directorist plugin for WordPress versions up to and including 8.5.10. Users running these or older plugin releases are vulnerable; any installation of Directorist 8.5.10 or earlier should be considered at risk.

The CVSS score of 5.3 classifies the vulnerability as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, suggesting no known high‑profile exploits. Attackers would likely need a web application entry point to try to reach protected areas, and the flaw can be abused by unauthenticated users or users with insufficient privileges. The lack of a high exploit probability suggests that active attack traffic may be limited, yet the potential impact warrants timely remediation.