The vulnerability is a missing authorization check in the GetResponse Email marketing for WordPress plugin that allows an attacker to bypass normal access controls. By exploiting this flaw, an attacker could read or write data that should be restricted, potentially accessing user leads or other sensitive information. This flaw is categorized as CWE‑862, which indicates improper authorization.

The plugin GetResponse Email marketing for WordPress by GetResponse Official is vulnerable in all releases up to and including version 1.5.3. Any WordPress site that has the plugin installed within this version range is affected, regardless of the WordPress core version.

The CVSS base score of 6.5 reflects a moderate level of severity. The EPSS score of less than 1 percent indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is over a web interface where the attacker can send crafted requests to plugin endpoints. Since no authentication prerequisite is mentioned, the flaw could potentially be leveraged by unauthenticated users to gain unauthorized access, but the exact conditions are not detailed in the description.