The admin plugin lacks an authorization check on a REST route, allowing attackers to update any WordPress option with arbitrary values. This flaw can change critical configuration settings, store and execute malicious scripts on every front‑end page, or move important posts to the trash. The weakness is a lack of access control (CWE‑284) with potential stored‑script injection (CWE‑79).

Plugin: Botiga Pro, version earlier than 1.6.5. The product runs on WordPress installations and is distributed as a WordPress plugin. No further vendor detail is available, but any WordPress site that has the legacy Botiga Pro plugin installed is affected.

Because the REST endpoint is unauthenticated, an attacker can reach it from any IP address. The EPSS score is not available and the vulnerability is not listed in the KEV catalog, however the lack of authorization coupled with the ability to modify global options makes the risk high. Exploitation would enable full site takeover by a remote attacker.