Missing Authorization in the LoginWP – Pro plugin allows attackers to execute operations that are not properly protected by the plugin's access control lists. The flaw permits unauthorized use of features that should be restricted to certain user roles, thereby exposing the WordPress site to potential misuse of the plugin's administrative functions. This weakness is classified as CWE‑862 – Missing Authorization.

Organizations that use the WordPress LoginWP – Pro plugin from Marketing Fire, LLC are impacted. All releases up to and including version 4.0.8.5 contain the flaw and are therefore vulnerable. The issue resides within the plugin’s internal administration code on a WordPress installation.

The CVSS score of 6.5 indicates a medium severity vulnerability that could allow compromise of the plugin’s privileged functions. The EPSS score shows a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited through the plugin’s web interface where authorization checks are missing; the likely attack vector is through standard WordPress administrative pages accessed by a user, though the specific prerequisites are not detailed in the advisory.