The vulnerability is a missing authorization flaw that allows unauthorized users to exploit incorrectly configured access control security levels within the Residential Address Detection plugin. This defect can lead to unauthorized access to plugin settings or functionalities, potentially enabling alteration of data or exposure of sensitive information. The weakness corresponds to CWE-862, indicating improper enforcement of authorization checks.

The issue affects the Residential Address Detection WordPress plugin developed by Eniture Technology. All releases up to and including version 2.5.4 are vulnerable; the affected range is indicated as n/a through <= 2.5.4.

The CVSS score of 6.5 classifies the defect as medium severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation under current conditions. It is not listed in the CISA KEV catalog. The most likely attack vector is via the plugin’s web interface, where an unauthenticated or low‑privileged user can interact with the plugin’s features without proper authorization checks.