The Sendy WordPress plugin suffers from a missing authorization check that allows attackers to bypass the configured security levels. This flaw is a classic broken access control issue (CWE‑862), enabling users who should not have certain privileges to gain unauthorized actions within the plugin. Such unauthorized use can compromise both the confidentiality and integrity of the data handled by the plugin.

WordPress sites that have installed the Sendy plugin up to and including version 3.4.2 are vulnerable. All users of these installations are at risk if the plugin is not patched or removed.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be through the web interface and requires the attacker to interact with the plugin’s functionalities. Because it is a broken access control flaw, an attacker can potentially maintain access to restricted actions if they have already authenticated, or could exploit the vulnerability without authentication if the plugin exposes administrative endpoints improperly.