WordPress plugin 'SALESmanago' is affected by a missing authorization flaw that permits an attacker to bypass the plugin’s access‑control checks. The vulnerability arises from incorrectly configured security levels and can lead to unauthorized viewing or modification of plugin data. It is categorized as a broken access control weakness (CWE‑862).

The flaw impacts the SALESmanago CMS plugin and the associated Leadoo implementation for all releases up through version 3.9.0. Administrators or users with any role can exploit the weakness to gain elevated permissions within the plugin. No specific OS or platform requirements are listed, only the WordPress environment hosting the plugin.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw via a web request to the plugin’s endpoints using either an authenticated session with insufficient role checks or possibly unauthenticated access if the plugin’s settings are misconfigured. Implementing the vendor’s recommended update as soon as possible is essential to mitigate the risk.