Missing Authorization vulnerability in WP Desk Flexible Subscriptions allows attackers to exploit incorrectly configured access control security levels, enabling unauthorized modification or disclosure of subscription data. The flaw is a classic broken access control issue (CWE‑862). While the vulnerability does not grant remote code execution, it permits an attacker with sufficient privileges to perform actions beyond the intended permissions, potentially compromising the confidentiality and integrity of subscription information.

The vulnerability affects the WP Desk Flexible Subscriptions WordPress plugin for all versions from the initial release up to and including 1.8.4. Any WordPress installation that has this plugin installed and not upgraded past version 1.8.4 is susceptible.

The CVSS score of 4.3 indicates a low to moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation. The likely attack vector involves a user with valid WordPress credentials and the opportunity to manipulate plugin settings without proper authorization checks. Attackers would need to identify and authenticate to the WordPress site first, then target subscription functions exposed by the plugin.