The CVE describes a missing authorization flaw in the CreativeMindsSolutions CM Registration and Invitation Codes plugin for WordPress. The plugin fails to enforce proper access checks, allowing users who should be denied to perform privileged actions such as creating, editing, or deleting registration and invitation codes. This compromise could affect confidentiality, integrity, and availability of the website by enabling unauthorized data manipulation or credential exposure.

The affected product is the WordPress plugin CM Registration and Invitation Codes from CreativeMindsSolutions. All releases up to and including version 2.5.6 are impacted. Users running these versions should upgrade the plugin to a fixed release before it can be exposed to potential exploitation.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% shows a very low proof‑of‑concept exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, targeting the plugin administrative interface; it does not require privileged authentication beyond the role that can access the plugin pages. No additional conditions are explicitly stated, so the flaw can be used by any user who can reach the vulnerable backend pages if the security settings are incorrect.