The Client Portal plugin for WordPress contains a missing authorization flaw that allows attackers to bypass access controls and reach features normally restricted to privileged users. This issue stems from improper checks on permission levels and is classified as CWE-862. Because the plugin does not enforce sufficient authentication or role validation, an adversary can send crafted HTTP requests to plugin endpoints and trigger functions reserved for administrators.

All deployments of the madalin.ungureanu Client Portal plugin for WordPress affected are versions from any prior release through version 1.2.1. Users running those versions must assess their current installation and plan for remediation.

The CVSS score is 4.3, indicating a moderate impact if successful. The EPSS score is less than 1%, suggesting a low current exploitation probability. This vulnerability is not listed in CISA’s KEV catalog, so no public exploitation is documented. Likely attack vectors involve remote requests via the WordPress web interface to plugin URL endpoints that lack role checks. The flaw is a breach of authorization rather than an injection or buffer overflow, so an attacker would need to trigger privileged functions, but the absence of checks could allow anyone with web access to perform those actions.