This vulnerability resides in the WordPress Avalex plugin version 3.1.3 and earlier, where missing authorization checks enable attackers to bypass intended access restrictions. The flaw permits unauthorized users to access or modify functionality that should be limited to privileged accounts, potentially exposing sensitive data or allowing further compromise. The weakness is a classic broken access control issue, classified as CWE‑862.

WordPress installations running the Avalex plugin up through version 3.1.3 are affected. The vendor identified is Avalex. The affected range is all releases from the beginning of the plugin up to and including 3.1.3.

With a CVSS score of 6.5 the vulnerability poses a moderate risk, and the EPSS indicates a very low likelihood of exploitation (<1%). It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers would need to reach the WordPress site and exploit the misconfigured access controls, likely via the WordPress admin interface or API endpoints, to gain unauthorized access. The impact could range from content manipulation to full site hijack depending on the privileges of the target account.