The vulnerability presents an unauthenticated broken authentication flaw that allows an attacker to bypass login checks in the CloudSecure WP Security plugin, enabling the execution of privileged actions on a WordPress site without valid credentials. This weakness is identified as CWE-288, which signifies improper authentication logic. The flaw could result in full control of the WordPress installation, compromising confidentiality, integrity, and availability of site data.

XServer’s CloudSecure WP Security plugin for WordPress, in all releases up to and including version 1.4.7. WordPress installations that have not applied the 1.4.8 or later update remain vulnerable.

The CVSS score of 8.1 indicates high severity, while an EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog, but attackers could reach the vulnerability through the WordPress web interface, potentially gaining full site compromise if the plugin’s authentication checks are successfully bypassed.