The Alma plugin for WordPress contains a missing authorization flaw that permits exploitation of incorrectly configured access control security levels. An attacker who can interact with the plugin’s endpoints may gain unauthorized access to privileged actions or data, thereby compromising the integrity and confidentiality of the site. The weakness is classified as CWE‑862, indicating that role or privilege checks are insufficient.

WordPress sites running the Alma "alma-gateway-for-woocommerce" plugin version 5.16.1 or earlier are affected. The vendor is Alma.

The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated or unauthenticated user exploiting exposed administrative endpoints, as the lack of proper authorization allows privilege escalation or disclosure of sensitive data. No additional requirements beyond interacting with the plugin’s interfaces are identified in the description.