Missing authorization in the Marketing Fire LLC LoginWP - Pro plugin allows an attacker to invoke functions that should be protected by access control lists. The vulnerability enables the unauthenticated or partially authenticated attacker to alter plugin settings, which could lead to unauthorized configuration changes and potentially elevate privileges within the WordPress installation.

The vulnerability affects Marketing Fire LLC’s WordPress LoginWP - Pro plugin, specifically all versions from an unspecified earlier release through 4.0.8.5. Any WordPress site using versions of this plugin up to and including 4.0.8.5 is impacted.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of <1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires at least authentication within the WordPress system, possibly via a normal user account, to manipulate plugin settings. The primary exploit risk is unauthorized configuration changes, which may be leveraged for further compromise within the application.