The vulnerability is a missing authorization flaw in the Loginplus plugin that permits unauthorized users to access functions that should be restricted by ACLs. Attackers can exploit this weakness to view or modify restricted content and perform actions reserved for privileged users. The flaw is classified as CWE‑862, which can lead to disclosure of sensitive data, manipulation of protected resources, and potential escalation of privileges within the WordPress installation.

The affected product is WordPress plugin Loginplus by Sanjay Prasad, version 1.2 and earlier. All installations of Loginplus from the very first release up to and including 1.2 are vulnerable. No other plugins or WordPress core versions are directly impacted by this issue.

The CVSS base score is 5.3, indicating a moderate severity. The EPSS score is below 1 %, suggesting that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw allows unauthenticated or minimally privileged users to bypass access controls, the risk remains significant for sites using the affected plugin. The likely attack vector is inferred from the description, where the attacker can directly access restricted URLs or API endpoints exposed by the plugin without authorization checks.