The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control levels within the WP Meta and Date Remover plugin. This flaw is classified as CWE-862 and can enable the attacker to access or modify plugin functionality that should be restricted, potentially leading to unauthorized removal of metadata or other privileged actions on a WordPress site.

The affected software is Prasad Kirpekar’s WP Meta and Date Remover plugin for WordPress, with versions from the initial release up to and including 2.3.6. Any WordPress installation using this plugin within that version range is impacted.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score is not available, suggesting limited current exploitation data. The vulnerability is not listed in the CISA KEV catalog. Given the web-facing nature of WordPress, the likely attack vector is a web request to the plugin’s endpoints, and the exploit requires the attacker to have network access to the site. While the impact is moderate, the potential to elevate privileges to a higher user role could be significant in permissive hosting environments.