The vulnerability is an Insecure Direct Object Reference that allows an attacker to bypass authorization controls in the WpStream WordPress plugin. By manipulating user-controlled keys, an attacker can retrieve content or files that should be restricted to privileged users. This leads to unauthorized disclosure of potentially sensitive data such as audio files, session recordings, or other media stored by the plugin.

Any WordPress site running the WpStream plugin version earlier than 4.11.2 is affected. The issue applies to all releases from the earliest available version up to, but not including, 4.11.2.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation typically requires the attacker to access the plugin’s URL structure and supply crafted parameters, indicating that the attack vector is indirect and depends on the application’s URL handling logic.