The vulnerability is a missing authorization flaw that permits users to dismiss or manipulate widget notices without proper permission checks. By exploiting this weakness, an attacker could hide or alter notifications that might otherwise alert site operators to security issues, thereby reducing visibility into the site’s state and potentially enabling further unauthorized actions or denial of service.

This issue affects the Marketing Fire Widget Options WordPress plugin for all releases from the earliest available version up through 4.0.8. WordPress sites running any of these plugin versions are susceptible.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests that widespread exploitation is low and the flaw is not listed in CISA KEV. The likely attack vector is via the web interface, where any authenticated user with access to the WordPress backend could trigger the notice dismissal. Because the attack does not require elevated privileges beyond normal authenticated access, the flaw can be leveraged by users with standard site roles, increasing its practical exploitability within administrative contexts.