The WP-CORS plugin for WordPress, versions up to and including 0.2.2, suffers from a missing authorization vulnerability. This flaw allows attackers with low privileges to exploit incorrectly configured access control mechanisms, potentially leading to unauthorized modification of data or settings within the plugin's scope. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level, with network attack vector, low attack complexity, requiring privileges, no user interaction, and unchanged scope. No patch or official fix is currently documented.

The vulnerability impacts the integrity of the affected system by allowing low-privileged users to perform unauthorized actions due to missing authorization checks. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for updates from the vendor or trusted security sources. Until a fix is available, restrict access to trusted users and review plugin usage to minimize exposure.