The WP Email Capture plugin has a missing authorization flaw that allows users to exploit incorrectly configured access control security levels. Attackers can access information or functionality that should be restricted to higher-privilege users, potentially exposing stored email addresses and related data. This issue does not provide remote code execution or denial‑of‑service but enables data disclosure and unauthorized use of the plugin's features.

WordPress environments running Rhys Wynne’s WP Email Capture plugin with versions from any initial release up through 3.12.4 are affected.

The flaw has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would likely need to interact with the web interface or make authenticated requests to the plugin’s endpoints, exploiting the lack of proper role verification. While the attack surface is limited to web requests, the impact of unauthorized data exposure can be significant for sites collecting user emails.