The Takeads WordPress plugin weakens authorization controls by failing to verify that a user is permitted to delete the plugin’s configuration options. An attacker who can authenticate to the site with subscriber-level access or higher can exploit this flaw to permanently remove the plugin’s settings, disrupting advertising functionality and potentially allowing further configuration changes.

WordPress installations that employ the Takeads plugin version 1.0.13 or earlier are susceptible to this issue. No other versions or other plugins are listed as affected.

The vulnerability carries a CVSS score of 4.3, indicating a moderate compromise of system integrity. Because the EPSS score is reported as < 1%, the likelihood of exploitation is deemed low, and the vulnerability is not presently listed in the CISA KEV catalog. Exploitation requires a valid authenticated session, so the attack vector is essentially an authenticated request, likely via the plugin’s Ajax endpoint. The impact is limited to a removal of configuration but could impair site operation if the plugin is critical. The overall risk is moderate but mitigated by the need for authentication and the low probability of active exploitation in the wild.