Unauthenticated Broken Access Control in the Outranking Plugin Options WordPress plugin allows an attacker to interact with privileged functions or view sensitive configuration settings without verifying the identity of the user. This weakness can potentially let a malicious actor alter settings, generate or delete content, or retrieve restricted data, compromising the integrity and confidentiality of the site.

WordPress sites running the Outranking Plugin Options plugin version 1.1.3 or earlier are affected. The vulnerability impacts the core functionality of the plugin as provided by the Outanking Team.

The CVSS score of 7.5 indicates a high severity level. Exploitation likelihood is not quantified by EPSS, but the lack of authentication controls makes the attack straightforward for an adversary who can reach the plugin's endpoints. The vulnerability is not currently listed in CISA's KEV catalog, yet its potential to grant elevated control makes it a priority remediation item. The likely attack vector is through crafted HTTP requests to the plugin’s administrative interface, which does not enforce proper authorization checks. If exploited, an attacker can gain unauthorized access to configuration or content modification capabilities.