The WP Legal Pages plugin for WordPress includes a disconnect_account_request() function that lacks a capability check (CWE-862). This flaw allows unauthenticated callers to invoke the API disconnect endpoint and force the site to disconnect from its external API plan, modifying connection state without any authentication or administrative privileges. The resulting impact is a loss of the active API plan and potential disruption of dependent services, but does not grant further access to site data or control.

All releases of the WP Legal Pages plugin up to and including version 3.5.1 are affected. The vulnerability exists in every affected installation on a WordPress site where the plugin is active.

The CVSS score of 5.3 places the flaw in the medium severity range. The EPSS score is reported as < 1%, indicating a very low predicted exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector is sending an unauthenticated request to the disconnect endpoint from any network location, as authentication is not required. Based on the description, it is inferred that the impact is limited to loss of the active API plan association and potential service disruption, with no additional privileges or data exposure.