The WPSection plugin for WordPress, in versions 1.5.1 and earlier, has a broken access control flaw that permits users who hold the Subscriber role to perform actions normally reserved for higher‑privileged users. This vulnerability is classified under CWE‑862: Broken Access Control and allows a Subscriber to view protected content or use administrative functions, thereby compromising the confidentiality and integrity of the site.

WordPress sites that have installed the WPSection plugin from vendor Rashid in any release whose version number is 1.5.1 or earlier. Any installation where a user is assigned the Subscriber role is susceptible to this breach.

The CVSS score of 8.1 marks this vulnerability as high severity. No EPSS exploitation probability is not quantified, but the flaw is likely to be exploitable by authenticated users. Based on the description, it is inferred that the likely attack vector is an authenticated request from a Subscriber account reaching the vulnerable plugin endpoints. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited, yet the high severity and authenticated nature of the vector present a significant risk for affected installations.