The flaw is an unauthenticated broken access control vulnerability that permits an attacker to view, edit, or delete content managed by the Intranet & Private Site – All‑One Intranet plugin. This can expose sensitive information and disrupt workplace communications. The underlying weakness is identified as CWE‑862, allowing unprivileged users to access privileged resources.

WordPress sites that have the Intranet & Private Site – All‑One Intranet plugin by Syed Balkhi installed in version 1.8.1 or earlier are affected. No other products are listed in the advisory.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score is not provided, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Based on the description it is inferred that the attack vector likely exploits the plugin’s administrative HTTP endpoints, allowing access without authentication. Successful exploitation would give an attacker unrestricted control over intranet content and potentially modify or remove it.