The Employee Spotlight – Team Member Showcase & Meet the Team plugin suffers from a missing authorization check in the employee_spotlight_check_optin() function, allowing authenticated users with Subscriber level access or higher to change opt‑in or opt‑out tracking settings. This flaw does not grant code execution or privilege escalation, but it permits an attacker to alter the tracking behavior of the site, potentially enabling unwanted data collection or disabling privacy safeguards.

WordPress installations running the Employee Spotlight – Team Member Showcase & Meet the Team plugin version 5.1.3 or earlier are affected.

With a CVSS score of 4.3, the vulnerability is considered medium severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Exploitation requires only authenticated access with Subscriber or higher privilege, so the attack surface is limited to sites that assign such roles to users who can access the plugin’s settings page. The impact remains confined to the tracking configuration and does not compromise broader system integrity or confidentiality.