Unauthenticated Broken Access Control in the Outranking Plugin Options WordPress plugin allows an attacker to interact with privileged functions or view sensitive configuration settings without verifying the identity of the user. This weakness can potentially let a malicious actor alter settings, generate or delete content, or retrieve restricted data, compromising the integrity and confidentiality of the site.

WordPress sites running the Outranking Plugin Options plugin version 1.1.3 or earlier are affected. The vulnerability impacts the core functionality of the plugin as provided by the Outanking Team.

The CVSS score of 7.5 indicates a high severity level. The EPSS score of < 1% shows that the probability of exploitation is very low, but because the vulnerability lacks authentication controls, an attacker who can reach the plugin’s endpoints could easily exploit it. The vulnerability is not currently listed in CISA's KEV catalog, yet its potential to grant elevated control makes it a priority remediation item. The likely attack vector is through crafted HTTP requests to the plugin’s administrative interface, which does not enforce proper authorization checks. If exploited, an attacker can gain unauthorized access to configuration or content modification capabilities.