This vulnerability is a missing authorization flaw in the WordPress “Filter Plus” plugin that allows users without proper privileges to perform actions such as modifying filter settings or accessing administrative functions. Because the plugin’s access checks are incorrectly configured, an attacker can elevate privileges within the site, potentially taking full control of the site’s configuration. The weakness originates from a failure to validate user roles before executing sensitive operations, classifying it as a missing authorization issue.

WordPress sites that have installed the Wpbens Filter Plus plugin version 1.1.17 or earlier. Any site using that plugin without updating beyond the specified release is vulnerable, regardless of other active plugins or themes.

The CVSS score and exploit probability are not provided, but the missing authorization flaw warrants high severity. The likely attack vector is inferred to be remote exploitation through crafted HTTP requests to the plugin’s endpoints, requiring an authenticated user who lacks the necessary permissions. Because the plugin does not enforce proper access checks, any such user can trigger the vulnerable behavior. No current exploitation has been reported and the issue is not listed in the CISA KEV catalog, yet the risk remains significant due to the ease of triggering the flaw once credentials are obtained.