The Klubraum Membership Request plugin for WordPress contains a missing capability check in the function that stores settings. This flaw lets an unauthenticated user update the plugin’s configuration, including the Klubraum API token and introductory text. An attacker could hijack the integration with the Klubraum service, potentially redirect API traffic, inject malicious content, or create a backchannel for further exploitation. The issue does not grant direct administrative privileges but enables a powerful user‑level configuration change that can be leveraged to undermine the site’s functionality or data integrity.

WordPress sites running the Klubraum Membership Request plugin version 1.1.0 or earlier are impacted. The vulnerability exists in all releases up to and including 1.1.0 and affects the admin settings handling code located in class-klubraum-membership-request-widget-admin.php.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1 % reflects a low probability of exploitation so far. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote unauthenticated attacker sending crafted HTTP requests to the plugin’s admin endpoint. Exploitation requires no prior authentication and can be performed from any network location that can reach the site's WordPress administration interface.