The CVE describes an unauthenticated Broken Access Control flaw in the WordPress Ebook Store plugin for versions 6.19 and earlier. The flaw allows an attacker without valid credentials to bypass normal authorization checks and perform actions that should be restricted. The weakness is classified as CWE‑862, indicating improper enforcement of access control.

Affecting the WordPress Ebook Store plugin distributed by motov.net, all installations using any plugin version up to and including 6.19 are vulnerable. No additional product or platform details are specified.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% signifies a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the flaw is unauthenticated, thus an attacker could send HTTP requests to the site to trigger the broken access control. The actual impact depends on the specific administrative functions protected by the authorization checks. The vulnerability could potentially allow attackers to alter the plugin’s state or content if such operations gated by the broken control.