The Enable CORS plugin for WordPress up to version 2.0.3 contains an unauthenticated backdoor that allows an attacker to execute arbitrary code on the host server. The flaw is rooted in CWE-321, which involves weak encryption or authentication controls. An attacker who can reach the vulnerable endpoint can gain full control of the WordPress installation, potentially compromising all hosted sites and data.

This vulnerability is limited to the Enable CORS plugin for WordPress developed by Dev Kabir. Versions 2.0.3 and earlier are affected. WordPress sites that have installed the plugin without updating to the latest patched release (starting at 2.0.4) are at risk.

The CVSS score of 7.4 indicates a high severity. No EPSS data is provided, but the unauthenticated nature of the backdoor means that exploitation is likely to be feasible once an attacker discovers the accessible endpoint. The vulnerability is not listed in the CISA KEV catalog. Because the plugin communicates over web requests, the attack vector is likely through HTTP or HTTPS traffic to the site. Prompt patching is strongly advised.