The defect resides in the AddNewPlan-inc.php component of the Insurance‑Management‑System. By manipulating the submit/Plan_no/Name argument, an attacker can bypass the authentication check that is expected before plan creation or modification. The flaw allows remote actors to create, edit, or delete insurance plans without providing valid credentials, leading to unauthorized changes to sensitive policy data.

The vulnerability impacts all deployments of the dhikshitha29 Insurance-Management‑System that expose the Plan Management Form. The developer has not released a specific version that contains the fix, and the project uses a rolling release model, so the affected range includes all currently available builds until an update is issued. The only product tied to the issue is the Insurance‑Management‑System; the specific file is /Admin/includes/AddNewPlan-inc.php.

The CVSS base score of 6.9 indicates a moderate impact, and because no EPSS data is available the likelihood of exploitation is unknown. The issue is not listed in the CISA KEV catalog, but the public disclosure and the remote nature of the attack mean that administrators should consider monitoring for malicious activity and applying corrective measures whenever a patch becomes available. As the flaw permits alteration of plan data, it could lead to financial loss or regulatory non‑compliance if exploited.