The vulnerability is a missing authorization check that allows an attacker to exploit incorrectly configured access control levels. An unauthorized user could perform actions reserved for higher‑privilege users, leading to unauthorized access or privilege escalation within the WordPress site. The weakness is classified as CWE-862.

The affected product is the Cozmoslabs Paid Member Subscriptions WordPress plugin, versions up to and including 3.1.3. The vulnerability is present in releases from the earliest code base through 3.1.3, affecting any WordPress installation that uses this plugin version.

The CVSS score of 5.3 indicates moderate severity. Exploitation would likely occur via normal web traffic, requiring the attacker to reach plugin endpoints that lack adequate authorization checks. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation evidence. Nevertheless, the absence of proper access control means a determined attacker could bypass restrictions to view or manipulate protected content.