The vulnerability is an unauthenticated broken access control flaw in the SiteGround Email Marketing plugin for WordPress. It allows an attacker to reach privileged actions or data within the plugin that should require authentication, as the plugin fails to verify the user’s access level. The result is a potential data leak or manipulation of marketing lists, which can compromise confidentiality or integrity of the user’s email marketing assets.

The affected software is the SiteGround Email Marketing plugin for WordPress, version 1.7.5 or older. This includes all WordPress installations that have not yet applied the 1.7.6 update from SiteGround. The plugin is developed by SiteGround and used by WordPress sites for email marketing integration.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely from any unauthenticated visitor who can make HTTP requests to the plugin’s exposed endpoints, which can be used to execute privileged plugin functions. Given the lack of hardening, the condition is likely to be met on a typical WordPress site, making exploitation feasible if the plugin is present and not patched.