The vulnerability is a broken access control that allows an unauthenticated attacker to perform privileged operations within the Gutenverse Companion plugin. The flaw originates from improper permission checks for administrative actions, corresponding to CWE-862. An attacker could alter plugin settings or expose sensitive data without authentication, compromising the integrity and confidentiality of the WordPress site.

The affected product is the Gutenverse Companion plugin developed by Jegstudio. Versions up to and including 2.5.0 are impacted; newer releases contain the fix.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an unauthenticated request to the plugin’s administrative endpoints, possibly through crafted HTTP requests or malicious links. Exploitation would require no special prerequisites beyond access to the site’s network.