The vulnerability is a missing authorization flaw in the WordPress AdMail plugin that allows attackers to bypass the plugin’s configured security levels. This broken access control enables an unauthorized user to access privileged functions within the plugin, potentially modifying notifications, viewing sensitive data, or initiating actions that should be limited to administrators. The weakness is classified as CWE-862: Missing Authorization.

The affected product is the aleswebs AdMail – Multilingual Back in-Stock Notifier for WooCommerce plugin. All versions from the earliest available through version 1.7.0 are vulnerable. Users running any of these versions on WordPress sites remain exposed until they upgrade beyond 1.7.0.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the attacker to send crafted requests to the plugin’s endpoints; the likely attack vector is remote via the web interface and does not require prior authentication.