Premmerce Redirect Manager allows an attacker to bypass access control checks, enabling unauthorized use of administrative functions. The missing authorization check can lead to disclosure of sensitive data, unauthorized changes to redirects, or manipulation of site behavior. The core weakness is a broken access control flaw.

Premmerce Redirect Manager plugin for WordPress, versions up to and including 1.0.12. All installations that have not been updated beyond this version are affected.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. An EPSS score below 1% suggests a low probability of exploitation at this time, and the issue is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is remote web-based exploitation, where an unauthenticated or low‑privileged user can send crafted requests to exposed plugin endpoints to gain higher privileges. Due to the lack of explicit authentication requirement in the description, it is inferred that no credentials are needed to trigger the privilege escalation, making the attack path relatively simple once the plugin is reachable.