The issue is a missing authorization flaw in the WordPress Sell Downloads plugin from codepeople, described as "Missing Authorization vulnerability". It allows an attacker to exploit incorrectly configured access control security levels. The primary impact is that users without sufficient privileges can potentially access protected download content or administrative functions, violating confidentiality and availability of the site. The weakness is classified as CWE-862, which is a missing authorization error.

The vulnerability affects the Sell Downloads plugin by codepeople for WordPress, versions from the earliest listed through 1.1.12. Any site running a vulnerable version should identify the installed plugin version and plan an upgrade.

With a CVSS score of 7.5 the flaw is moderately high in severity. The EPSS score of less than 1% indicates a low likelihood of public exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the most likely attack vector is an unauthenticated or low‑privilege user accessing or creating requests that bypass the plugin’s intended security checks, leading to unauthorized download of protected files or modification of purchase data.