The RPS Include Content plugin for WordPress contains a missing authorization flaw that allows users to access the plugin’s endpoints without passing the required permission checks. Because the plugin does not enforce user role validation, any visitor who can reach those URLs can invoke the exposed functionality. This issue is classified as CWE‑862, Missing Authorization.

WordPress sites that have installed the redpixelstudios RPS Include Content plugin version 1.2.2 or earlier are affected. The vulnerability applies to all users who can reach the plugin’s endpoints regardless of their role within WordPress.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the short term. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, so no public exploit is documented. The most likely attack vector is remote access to the website’s public URLs, as the plugin’s endpoints can be reached via the web interface; this inference is not directly stated in the input.