The vulnerability arises from a missing authorization check that permits users to alter plugin configuration. This weakness can enable an attacker to modify membership settings, potentially granting themselves or others elevated permissions, undermining site security, and impacting the integrity of membership controls. The issue is identified as CWE‑862, indicating improper authorization.

Affected systems are WordPress sites running the WP Membership plugin by e-plugins, version 1.6.3 and earlier. No specific sub‑versions are listed; all releases up to and including 1.6.3 are vulnerable.

The CVSS score of 5.4 reflects moderate risk, and the EPSS score of < 1 % indicates a very low likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need authenticated access to the WordPress backend and would exploit the flaw by navigating to the plugin’s settings page. The combination of moderate severity and low exploit probability suggests a measured threat that should be addressed promptly to prevent potential privilege escalation.