This flaw represents a missing authorization control in the WebToffee Accessibility Toolkit by WebYes plugin, specifically its accessibility-plus component. Attackers can use the plugin’s exposed management features to circumvent normal WordPress role restrictions and gain access to data or actions that should be reserved for higher‑privilege users. The weakness is a classic example of CWE‑862, where the system fails to enforce appropriate access controls.

The vulnerability affects the WebToffee Accessibility Toolkit by WebYes plugin, also known as accessibility-plus. All releases from the initial version through and including 2.0.4 are impacted. WordPress sites that have this plugin installed and have not upgraded beyond 2.0-4 are potentially susceptible.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that real‑world exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would most likely involve sending crafted requests to the plugin’s management interface, potentially as a logged‑in user with any role; a remote attacker could exploit the flawed access checks to perform unauthorized actions.