Missing authorization checks in the Leadrebel WordPress plugin allow users to access or invoke functionality that should be restricted by proper access control. The flaw is classified as CWE‑862, reflecting incomplete enforcement of authorization policies. Exploitation could cause the system to expose or alter resources that should only be available to privileged users.

All installations of WordPress that have the Leadrebel plugin at version 1.0.2 or earlier are affected. No additional WordPress core or plugin version constraints are specified, so the vulnerability applies broadly to any site meeting the plugin version criterion.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the description does not specify an exact attack path, it is inferred that the vulnerability may be exploitable via the plugin’s administrative interface or by any authenticated user under inadequate authorization controls.