The Safe SVG plugin for WordPress contains an insecure direct object reference flaw that permits an attacker to bypass ownership checks and access or modify SVG files owned by other users. This vulnerability, identified as CWE‑639, can lead to disclosure of confidential media, tampering of site graphics, or potential defacement. The reported CVSS score of 4.3 indicates a moderate severity, implying that while the flaw is not critical, it can still be abused by individuals who can identify or guess resource identifiers for target SVG files.

The issue affects installations of the 10up Safe SVG plugin at version 2.5.0 and earlier. No other vendors or WordPress plugins are indicated to be impacted.

The lack of an EPSS score and absence from CISA’s KEV catalog suggest low-known exploitation prevalence. However, the IDOR flaw can be leveraged by an authenticated user or an attacker who can guess a file’s URL, providing unauthorized read or write capabilities if file ownership checks are bypassed. Exploitation typically requires prior knowledge of the target file’s path or an active user session capable of enumerating SVG assets.