A missing authorization vulnerability in the bPlugins Info Cards plugin for WordPress allows authenticated attackers to perform unauthorized actions, posing a significant risk to site integrity.

This is a missing authorization vulnerability (CWE-862) occurring within the Info Cards plugin. The flaw allows any authenticated user with low-level privileges to interact with restricted plugin functionality due to insufficient access control checks.

Successful exploitation allows an attacker to manipulate plugin functionality, which may lead to unauthorized data modification or denial of service conditions. Given the CVSS score of 7.1, this represents a high-severity risk that could compromise the operational availability and integrity of the affected WordPress environment.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should disable or uninstall the Info Cards plugin until the vendor releases an official security update.

Proactive Monitoring: Monitor WordPress access logs for anomalous requests originating from low-privileged user accounts targeting plugin-specific administrative endpoints or AJAX actions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to sensitive plugin-specific file paths or parameters until the vulnerability is addressed.

Public Exploit Available: Unknown.

The presence of a missing authorization flaw in a widely used plugin type necessitates immediate attention to prevent unauthorized system manipulation. Administrators should prioritize disabling the affected component and verify that all user roles are configured with the principle of least privilege while awaiting a vendor-supplied fix.