WordPress sites that use the WP Social Avatar plugin version 1.5 or older are exposed to a broken access control flaw that allows any user, regardless of authentication status, to exploit privileged functionality. The vulnerability enables the attacker to access or manipulate content that should only be available to authorized administrators or users, potentially exposing sensitive avatar data or settings. The weakness is classified as CWE-862 and is reflected in a moderate CVSS score of 6.5, indicating that the impact is non‑trivial but not catastrophic.

All WordPress installations running Maruti Mohanty WP Social Avatar plugin version 1.5 or earlier are affected. No specific operating system or server configuration constraints are listed, implying that the issue exists across all environments where the plugin is deployed.

With a CVSS score of 6.5, the vulnerability carries a moderate risk. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it is not currently known to be actively exploited in the wild. The attack vector is likely application‑level; an unauthenticated attacker can craft requests that trigger privileged actions, though specific environmental prerequisites are not detailed in the description. The lack of a public exploit does not eliminate the risk, particularly for high‑value sites that host sensitive avatar information.