A high-severity broken access control flaw in the Agentimus WordPress plugin allows authenticated subscribers to bypass authorization checks, creating significant risk for site integrity.

This vulnerability involves a missing authorization check (CWE-862) that permits users with subscriber-level privileges to access restricted functions. The attack vector is network-based and requires a low-privileged authenticated user to trigger the flaw.

The ability for low-privileged subscribers to bypass access controls can result in unauthorized modification of site settings or data, potentially affecting SEO configurations or LLM integrations. Given the CVSS score of 8.1, this vulnerability poses a high risk to the confidentiality and integrity of the WordPress environment, necessitating immediate attention to prevent unauthorized administrative actions.

Immediate Action: Update the Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin to version 1.51.1 or the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user activity logs for suspicious requests originating from subscriber accounts that involve administrative or configuration-related endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized attempts to access plugin-specific administrative endpoints by non-administrative users.

Public Exploit Available: No

This vulnerability represents a significant security oversight that could lead to unauthorized administrative control within the WordPress application. Security teams should prioritize updating the affected plugin immediately to version 1.51.1, as this is the only definitive way to enforce proper authorization boundaries and mitigate the risk of unauthorized data or configuration changes.