A missing authorization flaw in the WP Socio WP Telegram Widget and Join Link plugin lets an attacker exploit incorrectly configured access controls. The weakness, identified as CWE‑862, enables unauthenticated users to use plugin features that should be restricted, potentially exposing configuration data or allowing unauthorized actions within the plugin’s scope. Property‑level privileges that are normally protected become available to any visitor attempting specific requests against the plugin’s endpoints.

All WordPress sites running WP Socio’s WP Telegram Widget and Join Link plugin from its first public release through version 2.2.12 are affected. The vulnerability applies to every environment where the plugin is installed and enabled, regardless of site size or user role configuration.

The CVSS score of 5.3 indicates a moderate impact, and an EPSS score of <1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog as of the latest data. The likely attack vector is remote, via crafted HTTP requests to the plugin’s endpoints that do not perform proper authentication checks, but this inference is drawn from the nature of the broken access control flaw and the plugin’s typical deployment context.