Missing Authorization vulnerability in the WP Media Adminimize plugin allows an attacker to exploit incorrectly configured access control security levels. The flaw lets an unauthorized user manipulate or bypass the plugin’s configuration settings, potentially granting elevated privileges or altering administrative behavior. This weakness is identified as CWE-862, which concerns missing authorization checks.

The vulnerability affects the Adminimize plugin provided by WP Media, affecting all installed versions from n/a up through 1.11.11. Users running any of these legacy releases are susceptible to the issue.

The CVSS score of 4.3 indicates a medium severity risk. Because the EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation appears limited, though the attack vector is likely local or requires at least a logged‑in user to interact with the plugin’s configuration pages. The risk level mainly depends on the presence of privileged users on the site who could use the vulnerability to gain unauthorized configuration access.