The vulnerability is a missing authorization flaw that permits attackers to bypass the plugin’s internal access checks and reach protected actions. When the Get Cash plugin is installed with any version 3.2.3 or earlier, requests that should be restricted can be generated by an unauthenticated or low‑privileged user. Because the plugin handles monetary or personal data, exposure can lead to disclosure or modification of sensitive values.

All WordPress sites that have the African Boss Get Cash plugin installed with a version number less than or equal to 3.2.3. The plugin is part of the African Boss product line, specifically the Get Cash component. No specific patch version is listed, so the recommendation is to upgrade beyond 3.2.3 or apply the vendor’s fix if available.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is less than 1%, suggesting the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. However, a remote attacker could send crafted HTTP requests that exploit the missing authorization and potentially read or alter financial data. Because the plugin is web‑exposed, the attack vector is likely remote. Organizations should treat this as moderate risk until patched and monitor exploit activity.