This vulnerability is a missing authorization flaw that allows the WordPress Connector to CiviCRM with CiviMcRestFace to be exploited when access control is incorrectly configured. An attacker who can reach the affected plugin’s endpoints may gain unauthorized access to protected functionality, potentially exposing sensitive data or modifying records. The weakness is identified as CWE‑862. The impact is that any user or service that can invoke the plugin’s API could perform actions beyond their intended authorization scope, which can compromise confidentiality, integrity, or availability of the CiviCRM data.

Users of the Jaap Jansma Connector to CiviCRM with CiviMcRestFace plugin, versions from the earliest release through 1.0.10, are affected. No narrower version range is specified beyond the stated upper bound.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests low likelihood of exploitation at this time. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector involves interaction with the plugin’s web interface or API endpoints; however, the exact prerequisites are not detailed, so the attack is considered to be possibly achievable via authenticated or unauthenticated access depending on site configuration.