This vulnerability involves missing authorization checks in the Auto Post After Image Upload plugin by Shaharia Azam, allowing users with limited privileges to perform actions beyond their intended access. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but with integrity impact. The affected versions are up to 1.6. No patch or vendor advisory is currently provided.

An attacker with some level of privileges could exploit the missing authorization to perform unauthorized modifications or actions related to the auto-post-after-image-upload functionality. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for unusual activity related to image upload and auto-posting features. Avoid granting unnecessary privileges to users who can interact with this plugin.