The Site Notify plugin for WordPress suffers from a missing authorization check, allowing attackers to bypass intended access restrictions. This broken access control flaw enables an unauthenticated or low‑privileged user to perform actions or view data that should be protected, potentially leading to data exposure or further compromise of the site. The flaw is categorized as CWE‑862, reflecting an improper authorization weakness.

The vulnerability affects the Site Notify plugin from the wpvsingh vendor. Versions up to and including 1.0 are impacted; no newer version information is specified.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The plugin is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the WordPress website interface, where an attacker could craft requests to plugin endpoints that lack proper role checks. No explicit exploit code is mentioned, but the missing authorization control allows an attacker to elevate privileges or access restricted content if the site exposes plugin URLs to unauthorized users.