The vulnerability is a missing authorization flaw in the WordPress iZooto plugin that permits actors to bypass intended access controls. This can lead to unauthorized manipulation of the plugin's features and data. The root weakness is an improper permission check (CWE‑862).

Affected software is the shrikantkale iZooto iZooto‑web‑push plugin, from the earliest releases up to and including version 3.7.20. Any WordPress site using these plugin versions is exposed; no other vendor or product is listed.

CVSS score is 5.3, indicating moderate severity, while the EPSS score is below 1 % and the vulnerability is not in the CISA KEV catalogue. The expressed bug concerns incorrectly configured access‑control levels, so exploitation could involve a web‑based attack that takes advantage of the plugin’s permission checks when interacting with administrative endpoints. The exact attack vector is not explicitly documented, but a web request that targets privileged plugin functionality is inferred as the most probable method. The low exploit probability and lack of a KEV listing suggest that active exploitation is currently unlikely; nevertheless, the medium severity and missing authorization warrant timely remediation.