The App for Cloudflare plugin for WordPress, versions 1.10.1 and earlier, contains a broken access control flaw that fails to enforce proper authorization. An authenticated user with subscriber‑level privileges can bypass role checks and perform actions or read data that should be restricted to administrators. This vulnerability therefore permits unauthorized access and privilege escalation within the WordPress site.

All WordPress installations that have installed any version of the digitalpoint App for Cloudflare plugin up to and including 1.10.1 are affected. The plugin is distributed under the digitalpoint banner and is visible in the WordPress plugin repository.

The CVSS score of 6.5 classifies the vulnerability as moderate. The EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote, as the plugin’s administrative endpoints can be accessed from any web browser or via automated scripts once a user has authenticated with subscriber credentials—this inference is drawn from the plugin’s web‑based nature and lack of explicit local‑only restrictions.