The Ays Pro Popup Like box plugin contains a missing authorization flaw that allows attackers to bypass built‑in access controls. This vulnerability is identified as CWE‑862 and enables unauthenticated or minimally privileged users to modify the plugin’s configuration or view protected data. If exploited, an attacker could change settings, inject content, or otherwise disrupt the intended operation of the WordPress site.

This issue affects all releases of the Ays Pro Popup Like box plugin through version 3.7.7 (inclusive). The affected product is the WordPress plugin Ays Pro:Popup Like box (ays‑facebook‑popup‑likebox) and any site that has installed this plugin with a version equal to or lower than 3.7.7.

CVSS score of 5.3 indicates a moderate severity. EPSS is less than 1 %, suggesting that at present, exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves authenticated web requests to the plugin’s endpoints because the flaw stems from incorrectly configured access control checks. While the vulnerability could be used to alter configuration or gain unauthorized information, it does not appear to provide full remote code execution or privilege escalation beyond the plugin’s scope.