The vulnerability arises from a missing authorization check that allows a malicious actor to access NitroPack settings without proper credentials. This can lead to unauthorized modification of plugin configurations, potentially rolling back performance optimizations, and exposing any sensitive data stored within the plugin. The weakness stems from an absence of proper access control verification, a type of missing authorization flaw.

WordPress sites using NitroPack plugin versions up to and including 1.19.3 are affected. The plugin is available for all standard WordPress installations that rely on NitroPack for optimization and caching, and every site running any of these affected plugin versions is at risk.

The flaw permits full administrative control over NitroPack, enabling attackers to alter configurations or potentially reveal cached content. No exploitation code is publicly referenced, and the vulnerability is not listed in the Known Exploited Vulnerabilities catalog. EPSS data is unavailable, so the likelihood of exploitation is uncertain, but the potential impact of gaining unprivileged administrative access is high.