The Share This Image plugin for WordPress suffers from a missing authorization flaw that allows an attacker to invoke privileged functions intended only for administrators or editors. This vulnerability can be abused to modify or delete content, view private data, or otherwise perform actions normally restricted to higher‑privilege users. The weakness is classified as CWE‑862, indicating an improper or missing access‑control check that undermines the intended security boundaries. Consequently, the plugin can expose confidential information, alter the integrity of site content, and potentially disrupt normal operation through unauthorized changes.

All WordPress sites that have the Share This Image plugin installed with a version number less than or equal to 2.12 are affected. The plugin is distributed by ILLID; no additional vendor or product details are provided in the input.

The CVSS score of 5.3 categorizes this issue as moderate severity, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via unauthenticated or low‑privilege web requests targeting the plugin’s exposed admin endpoints; if an attacker discovers or guesses these URLs, they can execute privileged actions without needing elevated credentials.