An unauthenticated broken access control flaw exists in the Thrive Leads Version plugin for WordPress, affecting all versions up to and including 10.9.2. This vulnerability allows an attacker with no prior authentication to access or manipulate protected plugin functionality that should be limited to authorized administrators. Because the flaw ignores or bypasses WordPress’s role‑based access checks, the attacker could read, modify, or delete lead data and potentially inject malicious content into the site. The breach compromises confidentiality, integrity, and user control over marketing data.

The flaw affects sites running the Thrive Leads Version plugin by Thrive Themes Coupon originating from Thrive Themes. Specifically, any WordPress installation that has the plugin version 10.9.2 or older is vulnerable; the issue does not extend to newer releases beyond 10.9.2. Users of the affected plugin should verify the version number under the WordPress plugin dashboard and account for updates from the vendor.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of 0.00242 (< 1%) indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV list, suggesting a lower current exploitation window. Nonetheless, an attacker can potentially trigger the flaw simply by sending crafted HTTP requests to the plugin’s internal endpoints, meaning the exploit is straightforward when the plugin is exposed, especially on insecure or publicly accessible WordPress sites. Prompt remediation is advised to prevent unauthorized data access.