The vulnerability is a missing authorization flaw in the Diet Calorie Calculator plugin that allows attackers to exploit incorrectly configured access control levels. Without proper checks, an unauthenticated or low‑privileged user can read or modify data managed by the plugin. The exploit does not provide arbitrary code execution or system takeover, but it can lead to privacy exposure and unauthorized manipulation of user data.

The affected product is the MWP Development Diet Calorie Calculator plugin for WordPress. Versions from the initial release through 1.1.1, inclusive, are impacted. No additional version granularity is provided.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of a broken access control issue in a WordPress plugin, the likely attack vector is a web request to a protected endpoint that should require higher privileges, which can be attempted by an unauthenticated user or one with minimal permissions.