This vulnerability arises from a missing authorization check in the WANotifier Notifier plugin. Incorrectly configured access control levels enable an attacker to bypass intended restrictions and gain unauthorized access to protected plugin functionality. The impact is a potential unauthorized use of the plugin’s features, leading to disclosure or modification of data that should be restricted to privileged users. The weakness is classified as CWE‑862, which indicates improper enforcement of authorization rules.

The affected product is the WANotifier Notifier plugin for WordPress. All releases from the earliest version through version 2.7.12 inclusive are vulnerable; no later version has been confirmed to be unaffected.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is less than 1%, demonstrating a very low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves leveraging web access to the plugin’s administrative interface. An attacker would need to either authenticate with any user account that the plugin allows or exploit a flaw that grants them elevated privileges. Even so, exploitation would likely require some level of prior access or knowledge of the plugin’s internal paths, making it a moderate, low‑probability risk.