BitFire Security, a WordPress plugin by Cory Marsh, contains multiple vulnerabilities that can be triggered without authentication. These weaknesses enable an attacker to perform unauthorized actions within the WordPress site, potentially compromising data confidentiality, integrity, or availability. The primary weakness is described by CWE-1284, indicating an authorization flaw that permits feature usage beyond intended user access levels.

WordPress installations running BitFire Security plugin version 5.0.3 or earlier are affected. The vulnerability applies to all sites that have not updated the plugin to the latest released version (at least 5.0.4). No additional system requirements are specified; the issue is confined to the plugin code itself.

The CVSS score of 8.6 reflects a high severity level, with a likely exploitation path that involves sending crafted requests to the plugin’s exposed endpoints without any authentication. Although no EPSS score is available, there is no evidence of current exploitation or a listing in the CISA KEV catalog, suggesting that active attacks are not documented. Nevertheless, the high CVSS combined with unauthenticated access indicates a significant risk that security teams should address promptly.