The vulnerability is a missing authorization flaw in the Team Manager plugin for WordPress, allowing attackers to bypass configured access control security levels. This flaw enables unauthorized users or those with insufficient privileges to access protected data or perform privileged actions within the plugin. Classed as CWE‑862, the weakness results in a potential escalation of privileges and unauthorized data exposure.

The affected product is Maidul Team Manager (WordPress wp-team-manager) for all versions up to and including 2.5.1. No specific release beyond 2.5.1 is mentioned as vulnerable.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed widespread active exploitation is reported. The likely attack vector is a web‑based request to the plugin’s administrative endpoints, and an attacker could exploit the missing authorization checks to gain unauthorized access, potentially without needing authentication, as the vulnerability description indicates a missing authorization flaw.