The vulnerability is a missing authorization flaw in the WPFactory Adverts adverts-click-tracker plugin that enables an attacker to use incorrectly configured access control security levels. The flaw allows non‑administrator users to perform actions that should be restricted, such as viewing or modifying advert click tracking data and potentially altering advert settings. This loss of confidentiality and integrity of advert metrics may expose internal campaign details.

The issue affects the WPFactory Adverts plugin for WordPress. All versions up to and including 1.4 are impacted. No later versions are known to contain the vulnerability.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability has not been reported in the CISA KEV catalog. The likely attack vector is a web based request from a user with standard privileges; the attacker would exploit the plugin’s admin endpoints to read or modify data or settings. No external code execution or denial of service is implied, but the impact on data confidentiality and integrity is significant.