Missing authorization in the BOX NOW Delivery WordPress plugin enables users to bypass configured security levels, allowing them to perform privileged actions without authenticating. The flaw is a broken access control that grants unauthorized users access to functions normally restricted to administrators or editors, potentially exposing sensitive content or configuration data. Attackers can exploit this to modify delivery settings, view restricted content, or manipulate plugin behavior, thereby threatening the integrity and confidentiality of the website.

All versions of the Box NOW Delivery WordPress plugin from the initial release through version 3.0.2 are impacted, meaning any WordPress site that has not upgraded past 3.0.2 exposes itself to this vulnerability.

With a CVSS score of 4.3, the vulnerability is considered low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation under current conditions. The issue is not listed in the CISA KEV catalog. The CVE does not explicitly state an attack vector; based on the plugin’s nature and the description, it is inferred that the flaw could be accessed via standard HTTP requests to the plugin’s endpoints, implying a network-based attack through the web interface. Although no widespread exploitation has been reported, organizations that rely on this plugin should consider the moderate risk of unauthorized access to protected functions.