This vulnerability in WP-Recall allows an attacker with low privileges to bypass authorization controls by manipulating user-controlled keys. The flaw is categorized under CWE-639, which involves authorization bypass through improper validation of user input used as keys. The vulnerability affects all versions up to 16.26.5. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker with low privileges can bypass authorization mechanisms, potentially allowing unauthorized actions that affect data integrity within the WP-Recall plugin. There is no impact on confidentiality or availability reported. The medium severity reflects the limited scope and impact of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published. Users should monitor vendor communications for updates and consider restricting access to affected plugin functionalities until a patch is available.