A missing authorization check in WisdmLabs Edwiser Bridge allows an attacker to bypass the plugin’s access control security levels. This flaw is a classic broken access control vulnerability identified as CWE‑862, meaning an attacker could potentially view, modify, or delete data protected by the plugin without proper privileges. The impact is the loss of confidentiality, integrity, and potentially availability of course management data stored by the plugin.

The vulnerability affects the WisdmLabs Edwiser Bridge WordPress plugin, versions from the first available release up through 4.3.2. No other products or versions are listed as affected.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not currently listed in the CISA KEV catalogue. Based on the description, the likely attack vector involves making authenticated or unauthenticated HTTP requests to plugin URLs or API endpoints that rely on the missing authorization check. An attacker sending crafted requests could gain privileged access to plugin data or administrative functions.