The vulnerability is a missing authorization flaw that permits users to invoke plugin functionality that should be limited to privileged administrators. An attacker could leverage these uncovered endpoints to manipulate spam filtering behavior, potentially bypassing the site’s spam protection or injecting harmful content. The flaw is identified as CWE‑862, representing a broken access control weakness that compromises the confidentiality and integrity of site data.

WordPress sites that have the Block Spam By Math Reloaded plugin installed at any version up to and including 2.2.4 are affected. The vulnerability applies to all installations regardless of user role, as the plugin fails to enforce ACL checks on its exposed actions.

The CVSS score of 5.3 indicates a moderate security impact. An exploit is considered low probability with an EPSS score of less than 1%; the vulnerability is not listed in the CISA KEV catalog. Based on the report, an attacker could reach the vulnerable functions via HTTP requests directed at the plugin’s endpoints, potentially from an unauthenticated or non‑admin user account. The attack vector is inferred, as the description states the absence of proper authorization checks.