A missing authorization flaw in the FloristPress plugin allows a user to bypass proper access controls, enabling them to view or manipulate administrative functions and data that should be restricted. The vulnerability arises from incorrectly configured security levels that do not enforce the necessary role checks, resulting in a clear break in the expected privilege boundaries. This flaw can compromise the confidentiality, integrity, and potentially the availability of the website’s management interface.

The affected product is the FloristPress plugin (bakkbone-florist-companion) developed by BAKKBONE Australia. All releases up to and including version 7.8.5 are impacted; newer releases beyond 7.8.5 have addressed the issue.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score is currently not available, indicating that there is no publicly documented probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker can interact with the plugin’s web endpoints, potentially using an unauthenticated or low‑privileged account, to trigger the unauthorized access. Because the lack of authorization is a hard flaw, any user who can reach the exploited functions may gain elevated privileges within the plugin’s scope.