Broken access control in the Really Simple SSL plugin allows a subscriber to perform privileged operations that should be restricted. The flaw exists in all plugin versions up to and including 9.5.9. An attacker who can authenticate as a WordPress subscriber, or create an account with that role, could gain unauthorized access to configuration settings, view or modify sensitive data, or otherwise elevate their privileges. The vulnerability is a type of improper authorization weakness (CWE‑862).

The affected product is the Really Simple SSL plugin developed by Really Simple Plugins B.V. Versions up to 9.5.9 are impacted. Sites running WordPress with any of these versions are at risk.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, so the real-world exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the WordPress site itself; an attacker would need to authenticate as a subscriber or forge an account with that role. Once authenticated, the broken authorization would allow access to privileged plugin functions.