The LMSACE Connect WordPress plugin contains a missing authorization check, allowing an attacker to exploit incorrectly configured access control security levels. This flaw is classified as CWE‑862 – Authorization Bypass Through User-Controlled Key. As a result, a user without legitimate privileges could gain unauthorized access to restricted portions of a WordPress site managed by the plugin or modify content intended for authenticated users.

All iterations of LMSACE Connect from the earliest available version up to and including 3.4 are affected. Site administrators should identify whether their WordPress installation uses any of these versions.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of < 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not included in CISA’s KEV catalog, reflecting no confirmed widespread exploitation. The likely attack vector is a web‑based interaction with the plugin’s administrative interface; however, this assessment is inferred from the plugin’s context and the nature of the missing authorization the description describes.