The WP-CORS plugin for WordPress, versions up to 0.2.2, suffers from a missing authorization vulnerability that results in incorrectly configured access control. This flaw allows users with limited privileges to bypass intended restrictions, potentially leading to unauthorized modification or interference with plugin functionality. The vulnerability does not affect confidentiality or availability but impacts integrity. The CVSS score is 4.3 (medium), reflecting the network attack vector, low attack complexity, and low privileges required without user interaction. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with low privileges can exploit the missing authorization to perform unauthorized actions that affect the integrity of the WP-CORS plugin's operation. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and restrict user privileges to minimize exposure. Monitor official sources for updates or patches addressing this vulnerability.