The RadiusTheme Team plugin contains a missing authorization flaw that allows an attacker to perform actions beyond the intended access control, enabling unauthorized access or modification of data within the WordPress site. The primary weakness is a missing authorization mechanism (CWE-862). According to the description, exploitation of this vulnerability could result in unauthorized changes but does not guarantee privilege escalation.

The RadiusTheme Team plugin, version 5.0.13 and earlier, is affected. The vulnerability applies to all releases from the initial version up to and including 5.0.13. No other version details are provided.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote via the WordPress web interface, as the flaw resides in a plugin accessed through HTTP requests. Exploitation would likely require the attacker to interact with the plugin's endpoints, but no authentication escalation beyond plugin-level privileges is explicitly described.