UnAuthenticated Broken Access Control in the Sermon'e plugin allows an attacker to perform privileged actions that should be restricted to administrators or authenticated users. The likely attack vector is through unauthenticated requests to plugin endpoints that lack proper authorization checks. This is a classic authorization flaw, preventing the enforcement of proper access checks and exposing sensitive functions to any visitor. Attacks could result in the exfiltration of sermon data, modification of worship schedules or other content that the plugin manages. The severity is measured at a CVSS score of 7.5, indicating a high impact on confidentiality, integrity, and potentially availability of the affected WordPress site.

WordPress installations that have the Beplusthemes Sermon'e plugin version 1.0.2 or earlier. No additional versions or configurations are listed; therefore any instance of the plugin with an affected release is vulnerable.

The likely attack path is straightforward: an unauthenticated user can send specially crafted requests to the plugin’s endpoints and bypass the missing authorization checks. Because the flaw does not require user credentials on the WordPress side, it can be exploited by anyone with network access to the site. The EPSS score indicates a probability of less than 1%, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating it is not yet widely exploited publicly. Nevertheless, the high CVSS score and easy exploitation make this a serious risk for any site that relies on this plugin.