The vulnerability allows an authenticated user with subscriber status to bypass the plugin's intended restrictions on access and actions. By exploiting this flaw, a user can perform operations normally limited to higher‑privileged roles, effectively gaining unauthorized capabilities. This flaw is classified as CWE‑290, indicating improper authentication or access control.

The plugin is developed by David Anderson / Team Updraft under the All In One WP Security & Firewall product. Version numbers up to and including 5.4.8 are affected. WordPress sites that have the plugin installed and have users with the subscriber role are at risk.

The CVSS score is 4.2, implying medium security impact. EPSS is not available, so exploitation likelihood is uncertain, and the vulnerability is not yet listed in the CISA KEV catalog. The most likely attack path involves a legitimate subscriber account; once authenticated, the attacker can construct a request that triggers the bypass logic. Because the tool is widely used, any WordPress installation running an outdated version of the plugin should consider patching promptly.