The vulnerability is a Missing Authorization flaw that allows an attacker to bypass configured security levels in the WC Lovers WCFM Marketplace plugin. The flaw permits users who are not granted sufficient privileges to perform privileged operations, effectively escalating their capabilities within the marketplace. The primary weakness is identified as CWE-862, a classic access control failure.

WordPress sites that have the WCFM Marketplace plugin enabled, specifically versions 3.8.3 and earlier. The plugin is distributed by WC Lovers under the WCFM Marketplace name.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity, and no EPSS data is available. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves accessing the plugin’s web endpoints using an authenticated user account that lacks proper authorization. The exploitation requires no special conditions beyond the ability to interact with the plugin’s pages, making the risk moderate but still actionable.