The vulnerability is a missing authorization flaw in the Zoho ZeptoMail plugin for WordPress that allows an attacker to perform actions beyond their intended privileges. By manipulating or accessing incorrectly guarded routes, an attacker can retrieve or alter sensitive email data. The weakness is classified under CWE‑862. The CVSS score of 4.3 indicates moderate severity, and because no public exploits are known, the risk is limited unless the attacker is specifically targeting WordPress sites that use this plugin.

Zoho Mail Zoho ZeptoMail Plugin versions from the earliest available through 3.2.9 are affected. Any instance using a plugin version older than 3.3.0 is vulnerable, while newer versions are not listed as affected.

The EPSS score of less than 1% suggests that exploitation attempts are expected to be very rare, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that an attacker would need to send crafted requests to administrative endpoints or exploit insufficient permission checks on the server side. Because the official rating is moderate and the probability of exploitation is low, the overall risk is considered moderate for sites that have not yet patched but is not an urgent emergency for all installations.