A missing authorization check in the Massiveshift AI Workflow Automation WordPress plugin allows attackers to bypass normal access controls and execute privileged actions on automated workflows. The flaw can be exploited to add, modify, or delete tasks, potentially exposing sensitive information or enabling further compromise. The weakness is identified as missing authorization (CWE‑862).

The vulnerability affects the Massiveshift AI Workflow Automation plugin for WordPress, version 1.4.2 and older. All releases from the earliest available version up through 1.4.2 are impacted, as the issue exists from the start of the product line until the stated limit.

The CVSS score of 5.3 classifies the vulnerability as moderate, while the EPSS score below 1% indicates a currently low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description and is a remote HTTP request to the plugin’s administrative endpoints; an attacker may exploit the flaw without needing valid credentials if access controls are misconfigured. Successful exploitation would compromise the integrity and availability of the site’s workflow automation features.