Missing authorization logic in the Addonify Quick View plugin allows attackers to exploit improperly configured access control levels, potentially granting unauthorized users privileged access to plugin functionality. The weakness could lead to sensitive information exposure or modification if the restricted actions are misused.

The vulnerability affects the Addonify Quick View plugin (Addonify) distributed for WordPress, with all released versions up to and including 2.0.4 exposed.

The CVSS score of 5.3 points to a medium severity issue, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, and there is no evidence of a current active exploit. Attackers would typically need to interact with the plugin’s web interface or craft specific requests to bypass normal WordPress role checks. Mitigation requires applying the vendor’s patch or taking only temporary controls.