The Tumult Hype Animations plugin for WordPress suffers from a missing capability check in the hypeanimations_getcontent function in all versions up to and including 1.9.14. This authorization bypass allows authenticated users with low-level privileges (Subscriber and above) to retrieve animation content data that should be restricted. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and limited impact on confidentiality only.

An attacker with Subscriber-level or higher access can retrieve animation information from the plugin without proper authorization. This results in unauthorized disclosure of potentially sensitive animation data. There is no impact on data integrity or availability. The vulnerability does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor plugin updates from Tumult Inc. No vendor advisory or patch links are currently available.