The 12 Step Meeting List plugin for WordPress contains a missing authorization flaw that permits users to access or manipulate meeting data that should be restricted. The primary impact is that an attacker with minimal access can view or modify meeting information, potentially exposing confidential schedules or altering content. The weakness maps to CWE-862, a broken access control issue.

The vulnerability affects AA Web Servant’s 12 Step Meeting List plugin versions up to and including 3.19.9. WordPress sites that have installed any of these versions are at risk and should consider upgrading. No further version details or variants are listed, so any site using an affected version is potentially impacted.

The CVSS score of 6.5 indicates moderate severity. EPSS indicates a very low likelihood of exploitation (<1%), and the issue is not in the KEV catalog, suggesting limited current exploitation. The likely attack vector is that a visitor or an authenticated user could send crafted HTTP requests to the plugin’s endpoints to bypass normal access controls; this inference comes from the description of “missing authorization” and typical plugin behavior. If the plugin is publicly accessible, attackers might first gather credentials or access the site to exploit the flaw.