The vulnerability arises from missing authorization checks in the SALESmanago Plugin, allowing users with incorrect or insufficient privileges to access restricted functions. It can potentially expose sensitive data or permit modifications to configuration settings, thereby compromising the integrity of the site. The weakness corresponds to CWE‑862, a flaw in access control enforcement.

The issue affects the SALESmanago and Leadoo plugin "SALESmanago" for WordPress, specifically all installations using version 3.8.1 or earlier. No later versions are known to be impacted.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score of less than 1% suggests that exploitation attempts are infrequent. The vulnerability is not currently listed in the CISA KEV catalog. While the exact attack vector is not detailed in the description, it is inferred that the flaw could be exploited via the WordPress admin interface or publicly accessible plugin pages that lack proper authentication. The impact is limited to users who can gain access to the compromised functionality, but it could enable broader unauthorized actions if the plugin is used for revenue or data tracking.