Missing authorization flaw in the Giveaways and Contests by RafflePress WordPress plugin permits users to invoke protected functionality without proper access control. The flaw allows an attacker to access or manipulate plugin features that should be limited to privileged users, potentially leading to unauthorized data exposure or modification. This issue is grouped under CWE-862 for missing authorization problems.

The vulnerability affects the Giveaways and Contests by RafflePress plugin from Syed Balkhi, for all versions up to and including 1.12.18. Site owners running any of these versions on WordPress are exposed.

The CVSS score of 5.3 indicates a medium severity with a moderate impact on confidentiality and integrity. The EPSS score of less than 1% suggests a low probability that the flaw is currently being exploited in the wild, and the vulnerability is not listed in CISA's KEV catalog. Exploitation would likely occur via a web-based attack vector, where an attacker submits crafted requests to the plugin's endpoints to bypass ACL checks. Since the flaw can be triggered remotely by submitting requests that are not properly authenticated, the risk remains present until patched.