A missing authorization flaw in the WordPress Cue plugin allows attackers to perform actions that should be restricted to privileged users. The vulnerability arises from incorrectly configured access control security levels, enabling unauthorized manipulation of plugin settings or site content. This can compromise the integrity of the site and expose sensitive data if combined with other weaknesses.

The issue affects the AudioTheme Cue plugin for WordPress, specifically all versions from the initial release through and including version 2.4.4. Administrators who have installed any of these versions are vulnerable.

The CVSS score of 4.3 indicates a moderate risk. The EPSS probability is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Attackers would likely need to interact with the WordPress admin interface or tamper with plugin settings remotely, but details on how to exploit the flaw in an operational environment are not specified in the advisory.