The vulnerability is a missing authorization flaw that allows an attacker to access or modify JetTabs content or settings that they should not be able to reach. The flaw arises because the plugin does not enforce its access control checks, permitting users with insufficient privileges to exploit functionality. Consequently, an attacker could elevate privileges within the WordPress site, read sensitive configuration data, or alter settings, potentially leading to further compromise. The weakness is identified as CWE‑862.

Crocoblock JetTabs plugin, versions through 2.2.12, is affected. The vulnerability applies to all disclosed releases up to and including 2.2.12. No specific distribution or application context is listed beyond the plugin within WordPress.

The CVSS score of 6.5 suggests a medium level of risk; the EPSS indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely exploit requires a web‑based request to JetTabs endpoints, which can be performed by a remote attacker with network access to the WordPress instance. No special prerequisites are mentioned beyond normal access to the site.