The Staff Training plugin for WordPress versions up to 1.0.7 contains an unauthenticated broken access control flaw. An attacker who can reach the plugin’s URLs can invoke privileged operations such as creating, editing, or deleting training records without authentication. This compromises the integrity of the training data and can expose sensitive information to the attacker. The vulnerability is a classic example of CWE‑862, where insufficient access checks allow unauthorized use of protected functionality.

Any WordPress installation that has the Staff Training plugin installed at version 1.0.7 or earlier is affected. The plugin provides administrative pages for managing staff training content; no explicit version information beyond the stated cutoff is available, so all prior releases are potentially vulnerable.

The CVSS score of 7.3 indicates a high severity, primarily due to the lack of authentication required for exploitation and the impact on data integrity. The EPSS score is not available, so the probability of exploitation is unknown, but the clear path through the web interface suggests that attacks could be straightforward. The vulnerability is not currently listed in the CISA KEV catalog, meaning no confirmed widespread exploitation has been documented. The likely attack vector is through a standard HTTP request to the plugin’s back‑end URLs, requiring no credentials and no special network conditions.