This vulnerability allows privileged users to bypass access controls for content or configuration managed by the WPCafe plugin. It could enable an attacker with subscriber level access to view or modify data that should be protected, potentially leading to disclosure or manipulation of site content.

The vulnerability affects WordPress installations running the WPCafe plugin version 3.0.14 and earlier, provided by the vendor Arraytics. Any site using these plugin versions is at risk.

The CVSS score of 4.3 indicates a moderate severity and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known wide‑scale exploitation. While the exact attack vector is not described, it is inferred that an attacker with some level of site access can exploit the broken control to gain unauthorized privileges.