The Ziina plugin for WordPress contains a broken authentication flaw that allows an unauthenticated agent to bypass login checks and gain access to administrative features of the plugin. This could let the attacker modify plugin settings, execute arbitrary server‑side actions, or potentially expose underlying WordPress data. The weakness corresponds to CWE‑1390, indicating a failure to enforce authentication on privileged operations.

Any WordPress installation running the Ziina plugin version 1.2.21 or earlier is affected. The vendor product is Ziina:Ziina, and the vulnerability applies to all releases up to and including 1.2.21. Sites that have not installed a later version carry the risk described.

The CVSS score of 7.5 reflects a high severity due to the lack of authentication and potential impact on confidentiality, integrity, and availability. The EPSS score of less than 1 % indicates that, as of the latest measurements, the probability of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the likely attack vector is remote HTTP requests to the plugin’s administrative URLs; this inference is based on the description of unauthenticated access to plugin functions, which would allow an attacker to exploit the flaw with minimal effort if the plugin is publicly exposed on the site.