The vulnerability is a missing authorization flaw in the MobiLoud WordPress plugin that allows an attacker to bypass the intended access controls. This flaw enables access to administrative functionality that should be restricted to users with higher privileges. The weakness is cataloged as CWE-862, indicating improper authorization.

Affected systems are sites that have installed any release of the MobiLoud plugin from all versions up through 4.6.5. The issue is specific to the plugin and does not depend on the underlying operating system or WordPress core version.

Risk is described as high by the CVSS base score of 8.1. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a crafted HTTP request to the plugin’s administrative endpoints, exploiting the missing checks. No additional conditions are disclosed beyond the missing authorization.