This vulnerability arises from a broken access control in the MainWP plugin for WordPress, affecting versions up to 6.1.1. It allows users with subscriber privileges to perform actions reserved for higher‑level roles, potentially giving them unauthorized access to sensitive data or the ability to modify site settings. The weakness is classified as a broken access control (CWE‑862).

The affected product is the MainWP plugin, a WordPress add‑on used for managing multiple sites. All installations of MainWP versions 6.1.1 or earlier are vulnerable.

The CVSS score of 6.3 places this vulnerability in the medium severity range. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to authenticate as a subscriber or have access to a subscriber account, after which the broken access control could be exploited via normal plugin interfaces. No additional exploitation conditions are specified.