This vulnerability involves missing authorization, allowing attackers to access plugin functions reserved for privileged users, potentially leading to unauthorized configuration changes or data exposure within the WordPress site. The weakness is a classic CWE-862 Broken Access Control.

The Sandwich Adsense plugin developed by rtakao, bundled with WordPress installations, is affected for all releases up to and including 4.0.2. No vendor–specified sub‑versions are listed, so any legacy installation using an older release of the plugin should be considered vulnerable.

The CVSS score of 5.3 indicates moderate severity, and an EPSS score of less than 1% suggests low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers likely need to authenticate with a WordPress user account that has sufficient privileges to reach the plugin's administrative interfaces, or they may exploit a configuration that mistakenly grants lower‑level roles access to plugin settings. Based on the description, the likely attack vector is via an authenticated privileged user accessing the plugin's administrative interface, though the CVSS base metric does not explicitly specify the vector. This path underscores the need for proper role‑based access controls.