Missing Authorization vulnerability in the WP Messiah WP Mobile Bottom Menu plugin allows attackers to bypass intended access controls and modify or delete plugin settings. The flaw enables an attacker to perform actions that should be restricted to privileged users, potentially compromising the configuration and behavior of the website. This type of weakness is identified as CWE-862, which indicates a failure of authority checks.

The vulnerability affects WordPress sites running the WP Mobile Bottom Menu plugin provided by WP Messiah. Versions from the initial release up to and including 1.4.0 are impacted. The issue is documented as affecting all releases identified by the plugin version range n/a through <= 1.4.0.

The vulnerability is scored with a CVSS of 4.3, indicating a moderate impact if exploited. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to involve web-based interaction with the plugin's administrative interface, likely requiring an authenticated WordPress user with limited privileges to elevate privileges. This inference is drawn from the description of the broken access control flaw.