The vulnerability is a broken access control flaw that permits an unauthenticated attacker to read or modify data managed by the WordPress Anti Spam and list cleaner – AcyChecker plugin. Because the plugin lacks proper authentication checks on certain endpoints, an attacker could alter plugin configuration or view sensitive data stored by the plugin, potentially compromising the integrity and confidentiality of the website's mailing list information. The weakness is categorized as CWE‑862, Unauthorized Access.

This flaw affects all installations of the WordPress Anti Spam and list cleaner – AcyChecker plugin up to and including version 2.0.0. Any WordPress site running these versions without an upgrade is vulnerable.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not provided, so the estimated likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely via unauthenticated HTTP requests to plugin endpoints that do not enforce proper authentication, and could be carried out from any network location where the WordPress site is reachable.