A missing authorization flaw in the WpXmas‑Snow WordPress plugin allows attackers to bypass access control checks. The vulnerability can enable unauthorized users to execute actions normally reserved for administrators, such as viewing, modifying, or deleting site content. It is identified as CWE‑862, indicating a failure to enforce proper authorization.

The plugin developed by Pankaj Kumar, version 1.1 and all earlier releases, is affected. Any WordPress site that deploys these versions of the WpXmas‑Snow plugin is at risk.

With no exploit probability data available, the inherent lack of authorization presents a significant risk of exploitation. An attacker could manipulate HTTP requests to reach plugin endpoints and perform privileged actions without proper authentication. The vulnerability threatens the confidentiality, integrity, or availability of the site if accessed by malicious actors. The problem is not listed in the Known Exploited Vulnerabilities catalogue.