A missing authorization flaw exists in the BoldGrid Help Scout WordPress plugin, versions up to and including 6.5.6, due to incorrectly configured access‑control security levels. The flaw allows attackers to invoke privileged functions without proper authentication, potentially enabling manipulation of the plugin’s internal state.

The affected product is the BoldGrid Help Scout plugin for WordPress. All releases of the plugin up to and including version 6.5.6 are potentially affected, meaning any WordPress site that has installed these versions is at risk.

The CVSS score of 4.3 indicates moderate severity and the EPSS score of less than 1% suggests exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be through the plugin’s administrative endpoints or front‑end interfaces that lack proper role checks; exploitation would involve interacting with these interfaces without the required privilege checks.