An access control issue in the Super Custom Login plugin allows attackers to bypass authorization checks. The missing authorization permits unauthorized users to reach protected areas or functionality provided by the plugin, potentially exposing sensitive configuration data or enabling further compromise. The weakness aligns with CWE-862, which describes missing or ineffective authorization controls.

WordPress sites that have the Super Custom Login plugin version 1.1 or earlier installed are affected. The issue was reported for all releases from the initial release through version 1.1 without an earlier fix. Site owners should confirm the plugin version and determine if the plugin is active.

The CVSS base score of 5.3 places this vulnerability in the medium range. The EPSS score indicates a very low probability of exploitation (<1%). The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. It is inferred that the attack could be carried out remotely by sending crafted HTTP requests to the plugin without prior authentication.