The CVE assigns critical severity, but the real failure isn't the collision requirement — it's what happens after. When this plugin determines an ID doesn't map to its own posts, it doesn't defer to WordPress's authorization system. Instead, it falls through to unrestricted processing of administrative operations including password resets and account deletion. The absence of a match in its internal mapping becomes the key that unlocks privileged functions. That's fundamentally different from a standard IDOR where an attacker must enumerate valid identifiers; here, the plugin actively creates the bypass condition.
The collision requirement (victim user ID matches a plugin post ID) isn't a meaningful constraint. WordPress installations accumulate post IDs continuously, making collision likelihood substantial in any active deployment. An attacker doesn't need a specific target — they iterate through post IDs sequentially until finding one mapped to a high-privilege user account. The requirement doesn't constrain exploitation; it just shifts reconnaissance from external probing to internal enumeration, which is trivial for any authenticated user with subscriber-level access.
Once the collision fires, the cascade enables full site takeover: reset any user's password, escalate that compromised account to Administrator, then delete competing administrator accounts. That's a single vulnerability mechanism producing complete access control collapse — no code execution, no memory corruption, no intermediate steps required.
This is a structural anti-pattern in WordPress plugins, not an isolated error. The pattern appears consistently: a plugin handling both domain objects and user operations where non-ownership triggers a fallback to privileged processing. The fix — adding a capability check at the cascade point — gets applied to each CVE individually while the underlying delegation architecture persists. The ecosystem response treats each instance as novel while the vulnerability class remains completely intact across thousands of plugins, many abandoned and unpatched.