The vulnerability is a Missing Authorization flaw in the Church Admin plugin that allows an attacker to access sensitive data. It leads to information disclosure without granting execution or denial of service capabilities. The weakness is classified under CWE‑862: Missing Authorization.

The affected product is the WordPress plugin Church Admin by andy_moyle. All releases from the initial version through 5.0.9 are vulnerable; newer versions are not listed as affected.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1 % suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The most likely attack vector is a remote HTTP request to the plugin’s endpoints directed at a WordPress site where the plugin is installed; an attacker would need to have network access to the WordPress installation. No public exploit code is documented, and the flaw is not an escalation to higher privileges beyond sensitive data access.