A missing authorization flaw in the Kargo Takip WordPress plugin removes critical access controls, allowing a user to view or modify protected data managed by the plugin. The weakness, identified as CWE‑862, does not grant execution privileges but directly undermines data confidentiality and integrity by letting an attacker bypass legitimate authentication checks.

All releases of the Kargo Takip plugin distributed by Özgür KARALAR, specifically versions prior to 0.2.4, are affected. WordPress sites installing the plugin before this version are at risk, as the vulnerability applies to every non‑patched instance of the add‑on.

The core exploit score of 6.5 indicates medium severity. The EPSS score is less than 1%, suggesting that the vulnerability is unlikely to see widespread exploitation currently. The flaw is not included in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, the attack vector is likely remote, through crafted HTTP requests to the plugin’s endpoints, and does not require elevated privileges beyond the ability to reach those URLs.