An unauthenticated Broken Access Control flaw exists in the WordPress BEAR plugin versions 1.2.2 and earlier. The vulnerability allows an attacker to bypass normal permission checks and invoke privileged plugin functionality without the need to log in. This could enable arbitrary modifications, content manipulation, or other privileged actions that should be restricted to authenticated administrators. The weakness is categorized as CWE-862. The consequences range from integrity violations to potential loss of trust in the affected site.

The vulnerability affects the WordPress BEAR plugin developed by RealMag777, specifically any installation running version 1.2.2 or older. No other vendors or products are known to be impacted.

The CVSS score of 7.3 indicates a high severity. The EPSS score of less than 1% indicates a very low probability of exploitation, although it is still present. Based on the description, it is inferred that the flaw can be exploited remotely via the web interface without prior authentication. The vulnerability is not listed in the CISA KEV catalog, but its high impact and lack of authentication pre-checks suggest it could be attractive to attackers. A successful exploitation would grant an attacker control over privileged actions within the plugin, potentially affecting the overall security posture of the WordPress installation.