The vulnerability is a missing authorization flaw, allowing attackers to bypass the intended access controls on the bPlugins Before After Image Comparison – Image comparison for WP plugin. An attacker who can reach the plugin’s endpoints may gain read or edit rights to image comparison data that should be restricted to authorized users. Since the flaw is a broken access control (CWE-862), the primary consequence is unauthorized disclosure or modification of image assets and potentially associated metadata.

The issue affects the bPlugins Before After Image Comparison – Image comparison for WP plugin for all releases from N/A through 1.1.21. The plugin is used on WordPress sites to provide before/after image comparison functionality, and any instances running a version 1.1.21 or older are vulnerable.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation is unclear. The plugin is not listed in the CISA KEV catalog. Because the flaw is related to incorrect configuration of access control security levels, the likely attack vector is through exposed plugin endpoints that can be accessed by unauthenticated or insufficiently privileged users. An attacker would need to identify the vulnerable URLs and then use them to read or manipulate image comparison data.