A missing authorization check in the StellarWP iThemes Sync plugin allows an attacker to bypass the normally enforced access controls and gain unintended access to the plugin’s administrative functions. This flaw enables users who are not normally granted privileges to perform actions such as viewing, modifying, or deleting synchronization settings, potentially exposing sensitive data stored or transmitted by the plugin. The weakness is a classic example of broken access control as defined by CWE‑862.

The vulnerability applies to all installations of the iThemes Sync plugin from the earliest release up to and including version 3.2.8. Any WordPress site running one of these versions of the plugin is potentially exposed.

The CVSS v3 score of 4.3 indicates moderate severity, while the EPSS value of less than 1% suggests a very low probability that the flaw is currently being exploited in the wild. The flaw is not yet listed in the CISA KEV catalog. Based on the plugin’s web‑based nature, it is inferred that an attacker would need network access to the WordPress site, and that the attack could be carried out through a typical browser or automated web request performing the unauthorized action once the flaw is leveraged. No special pre‑conditions beyond availability of the site and the plugin are stated.