The listed vulnerability is a missing authorization flaw that permits bypassing the access controls within the Leadrebel WordPress plugin. By exploiting this issue, an attacker could invoke functions or modify data that the plugin is intended to protect, effectively gaining unauthorized access or privilege escalation. The weakness conforms to CWE-862, representing broken access control.

All WordPress installations that employ the Leadrebel plugin version 1.0.2 or earlier are affected. The plugin is distributed by Leadrebel and operates independently of the WordPress core version, so any site running these older releases is vulnerable.

No CVSS or EPSS score is supplied, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, leaving formal risk metrics unavailable. Based on the description, it is inferred that the attacker can send crafted HTTP requests to the plugin’s endpoints, indicating a web‑based attack vector that requires network access to the site. The potential impact is high because the flaw allows privilege escalation, but the actual likelihood of exploitation remains uncertain due to the lack of detailed public exploits.