The vulnerability is a missing authorization check that allows attackers to access plugin functionality that should be protected by access control lists. A user who can send crafted HTTP requests to the affected endpoints could potentially trigger features, alter settings, or expose sensitive information provided by the plugin. This flaw is classified as CWE‑862 and leads to unauthorized access rather than arbitrary code execution or denial of service.

Infected systems include any WordPress installation that has installed Crocoblock’s JetMenu plugin version 2.4.9 or earlier. The issue applies to all releases preceding the announcement, as the vulnerability is listed from "n/a" through <= 2.4.9. Administrators should check their plugin version and determine if the site is using any of the affected states.

The CVSS score of 7.5 reflects high impact and medium complexity. The EPSS score of less than 1% implies few current exploits, but the flaw remains in the public domain and could be leveraged by attackers targeting vulnerable sites. The vulnerability is not currently catalogued in CISA’s KEV list. Attacks would likely involve authenticated users with limited privileges or unauthenticated users sending specially crafted requests; the exact attack vector is inferred from the description of an ACL conformance issue.