The vulnerability is an unauthenticated privilege escalation in the Taskbot plugin for WordPress that allows an attacker to gain administrative control over the site without prior authentication. This flaw stems from improper privilege management (CWE-266) and can compromise the integrity, confidentiality, and availability of the affected WordPress installation by enabling an attacker to modify content, create new accounts, or alter site settings.

The affected product is the Taskbot plugin, developed by AmentoTech, with any installed version up to and including 6.6 considered vulnerable. All WordPress sites that have Taskbot 6.6 or older installed are at risk regardless of the WordPress core version. The plugin can be publicly accessible or used within a protected environment, so all installations must be reviewed.

The severity is extremely high with a CVSS score of 9.8, and the EPSS score of < 1% indicates a very low probability that attackers will exploit this remotely at present. However, the unauthenticated nature of the attack vector lowers the barrier to exploitation, meaning that an attacker with network access to the WordPress site could trigger the flaw and immediately acquire admin privileges. The lack of a public exploit or KEV listing does not mitigate the risk, as the vulnerability is already exploitable via simple requests and would provide complete administrative control.