The WP AutoKeyword plugin for WordPress, developed by EXEIdeas International, contains a missing authorization vulnerability identified as CVE-2025-28997. This issue arises from incorrectly configured access control security levels, allowing unauthorized users to perform certain actions that should require authorization. The vulnerability affects all versions up to 1.0. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory is currently available.

The vulnerability allows unauthorized users to perform actions that should be restricted, potentially leading to unauthorized modification of data or settings within the WP AutoKeyword plugin. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild, indicating limited current exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality through other means, such as limiting administrative access or disabling the plugin if not essential.