A missing authorization flaw in the WordPress ApplyOnline plugin allows an attacker who reaches the plugin’s administrative endpoints to bypass the configured access control security levels. The identified weakness, CWE‑862, grants the attacker higher privileges than intended, potentially enabling the modification of configuration settings and content managed by the plugin. The impact is confined to users who can access the WordPress backend; it does not affect non‑authenticated users.

WordPress sites that have installed the ApplyOnline plugin version 2.6.7.6 or earlier are affected. The flaw applies to all releases from the earliest version through 2.6.7.6, as indicated by the vendor’s CVE notice. Administrators using WP Reloaded’s ApplyOnline plugin should verify whether their installation is at or below the vulnerable version.

The CVSS base score of 5.3 denotes moderate severity. The EPSS score of < 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting that no confirmed widespread exploitation is known. Attackers would need access to the WordPress backend to reach the plugin’s administrative endpoints, but no additional privileges are required beyond that, making exploitation straightforward for users with such access.