The vulnerability is a Missing Authorization flaw (CWE-862) in the Gagan Deep Singh PostmarkApp Email Integrator plugin. It enables attackers to access privileged functions or modify email integration settings without proper authentication, potentially exposing sensitive configuration data or manipulating email delivery.

Affected systems include WordPress sites that use the PostmarkApp Email Integrator plugin version 2.4 or earlier, including all releases from the initial version up to and including 2.4. The plugin is deployed by the vendor Gagan Deep Singh and is identified by the CNA as a broken access control component.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of < 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the described missing authorization, the likely attack vector is remote web‑based requests that bypass proper role checks, though the exact method of exploitation has not been detailed in the advisory.