This vulnerability in a WordPress file management plugin exposes a dangerous pattern: the endpoint correctly requires authentication (a valid session cookie), but performs no capability check before executing file operations. From a code review perspective, it looks secured — the session validation is real. The gap only becomes visible when you recognize that authenticated users span a privilege range from subscriber to administrator, and this endpoint handles them all identically.
The specific failure is that is_user_logged_in() was likely used as the authorization gate, or no authorization function was used at all. What you should check in your codebase: locate all endpoints that handle file operations (download, read, delete, enumerate) and verify they call current_user_can() with a capability appropriate to the operation — typically manage_options or a specific capability like edit_users for accessing sensitive configuration files. The key is that current_user_can('upload_files') is insufficient: that capability grants access to upload to wp-content/uploads, not to read arbitrary files across the filesystem.
The broader pattern to watch: WordPress authentication and authorization are separate systems that get conflated easily. A logged-in user is not an authorized user for sensitive operations. Any endpoint accepting user input and performing filesystem operations must have explicit capability assertions tied to that specific operation, not to general session validity. If you're auditing this plugin or similar ones, trace every file operation back to its capability guard and ask whether that guard actually restricts the specific operation being performed — most don't.
The CVSS 7.5 score understates this: one missing capability check is the only barrier between an authenticated subscriber and wp-config.php, database credentials, and plugin source code. This isn't just a missing check — it's a single point of failure that makes the entire WordPress installation contingent on that one authorization guard being present and correct.