A missing authorization flaw in the PublisherDesk The Publisher Desk ads.txt WordPress plugin permits attackers to exploit incorrectly configured access control mechanisms. This weakness empowers unauthorized users to read or potentially modify the plugin’s ads.txt configuration, allowing the injection of false or malicious ad entries that can redirect revenue, reveal internal data, or facilitate further exploitation of the site. The root cause aligns with CWE-862, a broken access control vulnerability.

WordPress installations that include the PublisherDesk The Publisher Desk ads.txt plugin, specifically any version up to and including 1.5.0.

The CVSS base score of 5.3 indicates moderate severity, while an EPSS score of less than 1% signals a low probability of exploitation in the wild. The vulnerability is not currently catalogued in CISA’s KEV inventory, reducing awareness among security teams. Based on the description, the likely attack vector is remote via unauthenticated HTTP requests to the plugin’s exposed endpoints. Exploitation would require an attacker to identify a site running a vulnerable version of the plugin and send crafted requests that bypass normal authorization checks.