Missing authorization in the Qubely plugin permits users without proper privileges to access or modify protected resources. The flaw is a classic broken access control vulnerability (CWE‑862), allowing attackers to perform actions intended for privileged users, such as editing or deleting content. This can result in content tampering, defacement, or exposure of sensitive information, thereby compromising the integrity of the website.

WordPress sites that have installed Themeum Qubely plugin version 1.8.14 or earlier are affected. All installations of the plugin regardless of site size are susceptible if the vulnerable version is present.

The CVSS score of 4.3 denotes moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker could exploit this flaw by sending crafted HTTP requests to Qubely API endpoints where authentication checks are missing, enabling unauthorized actions on the site.