Missing authorization in the Ninja Team GDPR CCPA Compliance Support plugin allows an attacker who gains access to the WordPress site to exploit incorrectly configured access control levels. The flaw means users may be able to perform actions beyond their intended permissions, potentially exposing confidential data or modifying site settings. This weakness is identified as CWE‑862 and is described as a broken access control vulnerability.

The vulnerability affects the WordPress plugin Ninja Team GDPR CCPA Compliance Support, version 2.7.1 and earlier. Users running the plugin on a WordPress installation with a version at or below 2.7.1 are impacted.

The CVSS score of 4.3 indicates a medium impact if exploited. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently being actively leveraged by threat actors. The likely attack vector is through a web interface that employs the plugin, where an attacker can take advantage of the missing authorization checks to elevate privileges or access restricted data. No exploit conditions are noted beyond the requirement to have access to the affected WordPress site.