A missing authorization check in the Netgsm WordPress plugin allows an attacker to bypass normal access controls, granting unauthorized users the ability to interact with protected functionality. The flaw does not lead to remote code execution but can enable users to view or modify data intended to be restricted, potentially compromising confidentiality and integrity of the site’s content and configuration.

The vulnerability is present in the Netgsm plugin for WordPress, affecting all releases from the initial version up to and including 2.9.69. Users running any of these versions should treat the plugin as compromised until a fix is applied.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s administrative endpoints, which an attacker could access if they have credentials or can send crafted requests to those URLs. Based on the description, it is inferred that an attacker who can reach the plugin’s endpoints—either through compromised credentials or by exploiting the site’s administrative interface—may be able to perform privileged actions. No remote execution vector is specified, implying the risk is limited to unauthorized use of the plugin’s protected features.