The vulnerability is a missing authorization flaw in the Super Custom Login WordPress plugin that allows an attacker to exploit incorrectly configured access control security levels. Because the plugin does not enforce proper checks, unauthenticated or insufficiently privileged users could potentially access or modify settings, view sensitive information, or perform administrative actions that should be restricted. The impact is a direct loss of confidentiality, integrity, or availability of the website’s configuration and possibly user data.

WordPress sites running the Obadiah Super Custom Login plugin version 1.1 or earlier are affected. The vulnerability applies to all releases in this range, regardless of configuration, until the plugin is updated beyond 1.1.

The available data does not include a CVSS score or EPSS value, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web-based exploitation path through the plugin’s login or configuration interfaces, given that access control checks are missing. An attacker would need to have some form of access to the site, possibly an existing user account or the ability to send crafted requests, and would exploit the lack of authorization controls to elevate privileges within the WordPress environment.