A missing authorization check in the ActiveDEMAND plugin permits users without proper permissions to invoke functions that are not properly constrained by access control lists. The flaw is a classic example of a broken access control vulnerability, classified as CWE‑862. An attacker who can reach the affected components can perform the restricted actions as if they were an authorized user, potentially exposing sensitive data or altering site behavior.

The vulnerability affects the ActiveDEMAND Online Agency Marketing Automation WordPress plugin, specifically all releases from the first version through 0.2.46. Users running this plugin on their WordPress sites are potentially exposed.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog. Because the flaw addresses a remote, web‑based interface, the attack vector is inferred to be Remote Network via the WordPress front‑end. An attacker needs only web access to the site and the ability to construct requests to the exposed plugin endpoints to exploit the flaw.