The DEPART plugin contains a missing authorization flaw that permits exploitation of incorrectly configured access control security levels. This allows an attacker to gain unauthorized access to administrative functionalities within the WordPress site, effectively escalating privileges and potentially compromising sensitive data or site operations.

The vulnerability affects the DEPART plugin by Andy Ha, version 1.0.7 and earlier. All installations of DEPART deployable through WordPress are susceptible until the plugin is updated beyond these earlier releases.

The CVSS score is not supplied, and no EPSS metric is available, but the flaw enables an attacker to bypass normal permission checks. The attack vector is most likely performed remotely over the web, exploiting exposed plugin endpoints. Because the issue has not been marked in the CISA KEV catalog, no publicly-known exploits exist at this time.