The vulnerability is a missing authorization flaw that allows attackers to bypass the required checks for protected endpoints in the PopCash.Net Code Integration Tool plugin. This can enable unauthorized users to read, modify, or delete sensitive plugin data and settings, potentially compromising the security posture of the entire WordPress site. The weakness corresponds to CWE-862 (Broken Access Control).

The issue affects the PopCash.Net Code Integration Tool plugin for WordPress, developed by PopCash. Versions up to and including 1.8 are impacted. Users who have installed any of these versions on their WordPress installations are vulnerable until they upgrade.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can gain access by sending crafted HTTP requests to the plugin’s admin URLs, exploiting the lack of proper access checks; the likely attack vector is remote via the public web interface. Therefore, there is a modest but real risk if the plugin remains unpatched and its administrative interfaces are exposed to untrusted users.