The WP Custom Admin Interface plugin fails to enforce proper authorization checks, allowing users who lack sufficient privileges to reach protected administrative pages. This missing authorization flaw permits unauthorized users to perform actions that should be restricted to administrators, potentially exposing sensitive configuration or data. The vulnerability is a classic example of CWE-862, which describes missing authorization mechanisms.

The flaw affects the Northern Beaches Websites WP Custom Admin Interface plugin for all releases up to and including version 7.41. Users running any version in the range n/a through 7.41 are exposed to the risk.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. While the attack likely involves interacting with web pages or API endpoints that should be role‑restricted, no advanced exploitation or remote code execution is documented. Nonetheless, the potential for unauthorized configuration changes warrants timely remediation.