Technical impact
The vulnerability is a missing authorization flaw that lets an attacker bypass the access control settings of the WP Document Revisions plugin. It falls under CWE-862, indicating an authorization bypass. The impact is that attackers can view or modify documents that should be protected, compromising confidentiality and integrity of the document repository.
Affected Systems
The affected product is Ben Balter’s WP Document Revisions plugin for WordPress. Versions older than 4.0.0, including all releases up to 3.8.1, are vulnerable. This includes any deployment that has not yet upgraded to the patched release.
Risk and Exploitability
The CVSS score of 7.5 classifies the flaw as high severity, highlighting the potential for significant damage if exploited. The EPSS score is not available, suggesting limited publicly observed exploitation but the risk remains real. The vulnerability is not listed in CISA’s KEV catalog, meaning there is no documented or confirmed exploitation to date. Based on the description, the likely attack vector is an authenticated or improperly restricted use of the plugin, whereby an attacker can exploit incorrectly configured access control security levels to discover or manipulate documents.
