The Voidek Employee Portal plugin for WordPress allows unauthenticated users to trigger several AJAX actions without performing a capability check. This missing authorization validation permits attackers to create new accounts, delete existing users, and modify employee details. The weakness is a classic missing permission verification (CWE‑862) that can compromise confidentiality and integrity of the portal’s user data.

Any WordPress site running Voidek Employee Portal versions up to and including 1.0.7 is affected. No version information beyond 1.0.7 is listed, so installations of that or older releases are vulnerable.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers only need access to the relevant AJAX endpoints, so the vector is inferred to be remote, unauthenticated. If exploited, the attacker could create accounts, delete users, and alter employee details, compromising the integrity of the portal’s data.