This vulnerability is a Missing Authorization flaw in the WP Bakery Autoresponder Addon plugin for WordPress. The plugin’s access controls are incorrectly set, allowing users to perform actions beyond their intended scope. An attacker who can interact with the plugin’s interfaces could gain elevated privileges, potentially taking full control of the affected WordPress site. The weakness is categorized as CWE‑862, representing an explicit missing authorization failure.

The affected product is the WP Bakery Autoresponder Addon plugin developed by kamleshyadav. All installed copies of the plugin with versions up to and including 1.0.6 are impacted. No other versions or vendors are listed as affected in the current advisory.

The advisory assigns a CVSS score of 6.5, indicating a medium severity vulnerability. The EPSS score is reported as less than 1%, implying a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits have been reported. Based on the description, the likely attack vector involves interacting with the plugin’s exposed endpoints or administrative UI within a WordPress deployment, so an attacker would need access to run or craft requests against the web application.