The WP Subscribe plugin contains a missing authorization flaw that permits attackers to bypass intended access controls and gain unauthorized actions within the plugin. The vulnerability stems from incorrectly configured security levels, allowing users without proper permissions to exploit plugin functionalities. This can lead to unauthorized configuration changes or exposure of data within the WordPress site.

All installations of MyThemeShop WP Subscribe plugin version 1.2.16 or earlier are affected. If the version number is unknown, verify whether the plugin is 1.2.16 or lower; those versions are vulnerable.

The CVSS score of 4.3 denotes moderate severity, and the EPSS score is below 1%, indicating a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would identify the plugin on the website, then use the exposed access control weakness to perform unauthorized actions scoped to the WordPress site. It is not stated whether exploit code is publicly available, but the lack of proper authorization checks means that an authenticated user could elevate privileges within the plugin context.