The Easy Notify Lite plugin allows any authenticated user with Subscriber level or higher to execute the easynotify_cp_reset function without a proper capability check. This flaw permits the attacker to reset all plugin configuration to the default state, potentially disabling custom notifications, altering site behavior, or causing a denial of service through configuration loss. The vulnerability is rooted in a missing authorization check (CWE-862).

The issue affects the Easy Notify Lite plugin developed by GhozyLab, with all releases up to and including version 1.1.37. No other products or later versions are listed as impacted in the current data.

The CVSS score of 5.4 indicates medium severity. The EPSS score of less than 1% suggests a relatively low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires only authenticated access at the Subscriber level or above, an attacker who has compromised or obtained a Subscriber account can trigger the reset with a simple HTTP request to the plugin’s action endpoint. No additional system or network privileges are needed beyond those granted to the user role.