The discovered weakness is a missing authorization check in the Reoon Email Verifier WordPress plugin, which lets an attacker bypass the plugin’s access controls. When an attacker can gain unauthorized access, they may read or alter the data managed by the plugin or perform actions that should be restricted to privileged users. This flaw is classified as a broken access control and falls under CWE‑862.

The vulnerability affects the Reoon Email Verifier plugin for WordPress, versions up to and including 2.0.1, sold by Reoon Technology. Any WordPress site that has this plugin installed and has not published a patch for the problem is potentially impacted.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability that this flaw will be actively exploited in the wild at the time of analysis. The vulnerability has not been listed in the CISA KEV catalog. Based on the plugin’s nature and the description, the likely attack vector is remote exploitation through web requests that target the plugin’s unsecured endpoints, allowing unauthenticated users to bypass normal access restrictions.