The vulnerability in the Vulnity Security WordPress plugin allows an unauthenticated attacker to retrieve a dedicated server configuration snippet that is intended to protect the delegated-login pairing credential file. The inadequate protection permits disclosure of stored credentials, which can then be used to forge signed REST API requests and authenticate as an administrator. This represents an authentication bypass (CWE‑287) that compromises confidentiality by exposing privileged credentials and integrity by enabling unauthorized access to administrative functions.

WordPress sites running the Vulnity Security plugin, version 1.4.3 or earlier, regardless of operating system, but specifically on Nginx‑based installations due to the misconfigured directory guard in the generated server configuration snippet.

The severity of this flaw is reflected by a CVSS score of 8.1, placing it in the high range. The EPSS value is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate likelihood of widespread exploitation at this time. However, because the flaw enables full administrator access without any prior authentication, the potential impact is substantial. An attacker would first need to access the Nginx configuration file through the exposed directory path, then extract the pairing credential. Once in possession of the credential, forging a signed REST API request is trivial, allowing seamless login as an administrator. The attack vector is likely remote, originating from any user who can issue HTTP requests to the vulnerable WordPress site.