The vulnerability is a missing authorization flaw in the LeadConnector plugin for WordPress, allowing attackers to exploit incorrectly configured access control levels. This results in broken access control, enabling unauthorized users to read or modify data managed by the plugin. It is classified as CWE-862, indicating that the system does not enforce proper access checks.

LeadConnector plugin for WordPress, versions up to and including 3.0.21 are vulnerable. All installations of the plugin within that version range are susceptible regardless of configuration settings.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is below 1 %, suggesting low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Attackers could target the plugin via the WordPress administrative interface, potentially requiring authentication or exploiting default credentials. The lack of explicit authorization checks implies that users with any authenticated role that can access the plugin could potentially perform privileged actions, so the attack vector is likely a web‑based exploitation path within the WordPress environment.