The vulnerability is a Missing Authorization flaw in the weDevs Subscribe2 WordPress plugin that enables exploitation of incorrectly configured access control security levels. An attacker can gain unauthorized access to subscription management functions, bypassing normal role restrictions, potentially modifying subscription settings, issuing emails, and accessing private subscriber data. The weakness is classified as CWE-862.

The issue affects the weDevs Subscribe2 plugin, with all releases up to and including version 10.44 being vulnerable. Any WordPress installation running an affected version of this plugin is at risk; no specific operating system or WordPress major version is specified.

The CVSS score of 6.5 indicates a moderate risk level, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to the plugin’s administrative endpoints, and an attacker would need to circumvent the plugin’s access controls to perform unauthorized actions. Because no publicly reported exploit exists and the exploitation potential is low, the overall risk remains moderate but requires timely mitigation.