The Maspik plugin for WordPress lacks a capability check in its spam‑log export function, allowing a logged‑in user with subscriber level or higher to download a CSV file that contains all recorded spam attempts. If legitimate submissions were mistakenly flagged as spam, the exported data could include sensitive user information, creating a confidentiality breach rather than a denial‑of‑service or code‑execution scenario.

All releases of Maspik – Ultimate Spam Protection version 2.5.6 or earlier are affected. The vulnerability operates within the WordPress plugin framework and can be triggered by any authenticated user who has at least subscriber privileges. Versions newer than 2.5.6 incorporate the missing authorization check and are not susceptible.

The CVSS score of 4.3 indicates medium severity. An attacker only needs an existing subscriber‑level account and knowledge of the export endpoint; no additional privileges or remote code execution are required. The EPSS score is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Despite its low exploitation probability, the potential to exfiltrate sensitive data warrants prompt attention, and monitoring for unauthorized export attempts is advisable.