The vulnerability is a missing authorization flaw in the HivePress Claim Listings plugin that allows an attacker to interact with claim listings without proper authentication or privilege checks. This flaw can lead to the unauthorized reading, modification, or deletion of listing data, potentially compromising the integrity and confidentiality of the information exposed by the plugin. The weakness corresponds to CWE-862, indicating a failure to enforce proper access control.

All installations of the WordPress HivePress Claim Listings plugin with versions up to and including 1.1.4 are affected. The plugin is distributed by HivePress and can be found in WordPress sites that have not upgraded beyond this version.

The CVSS score of 4.3 indicates moderate severity; however, the absence of an EPSS score and lack of listing in the CISA KEV catalog suggest that active exploitation is not widely documented. The attack vector is inferred to be remote, requiring the attacker to have access to the application’s web interface. Once the flaw is exploited, the attacker can potentially read or alter claim listings, impacting data integrity and privacy on the affected site.