The vulnerability is a missing authorization check that allows users with insufficient privileges to access or modify Team plugin data and features that should be restricted. This can lead to unauthorized disclosure or modification of content, potentially compromising the integrity and confidentiality of the website. The weakness is identified as CWE-862.

The affected product is the RadiusTheme Team plugin (tlp-team) for WordPress. Versions up through 5.0.6 are vulnerable; all earlier releases are also affected, but no specific versions are listed.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation in the wild. The vulnerability is not currently in the CISA KEV catalog. Attackers are likely to need authenticated access or rely on mis‑configured ACL settings; this is inferred from the description. A successful exploit could allow privilege escalation within the plugin’s namespace, enabling the attacker to read or change data that should be protected.