The vulnerability is an unauthenticated privilege escalation affecting WordPress sites that use the Listdom plugin version 5.5.0 or earlier. It is a type of weakness identified as CWE-266, where authorization is bypassed. An attacker can elevate privileges without authentication, potentially taking full administrative control of the site.

WordPress sites that have the Listdom plugin from Webilia Inc. installed at version 5.5.0 or earlier.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1% shows low current exploitation probability. It is inferred that a remote attacker can trigger the flaw by sending crafted HTTP requests to the plugin’s exposed endpoints, enabling the attacker to perform actions at elevated privilege levels. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet.