A missing authorization check in the Mulika Team MIPL WC Multisite Sync WordPress plugin allows an attacker to exercise functionality that should be limited to privileged users, such as synchronizing data across sites or altering plugin settings. This can lead to unauthorized data manipulation or privilege escalation if other vulnerabilities are present.

WordPress sites that have the MIPL WC Multisite Sync plugin installed and are running version 1.4.4 or earlier are affected. Any site using these versions is potentially vulnerable.

The CVSS score is not disclosed and EPSS data is unavailable, indicating no current public exploitation reports. The likely attack vector is via unauthenticated or insufficiently authenticated web requests to the plugin’s administrative endpoints where the access control check is omitted. The vulnerability exploits a missing authorization control, so it requires the attacker to reach the plugin’s endpoints; the complexity and effort are moderate, and the potential impact includes unauthorized data handling and possible escalation in the site’s ecosystem.