The Loops & Logic plugin for WordPress contains an unauthenticated broken access control flaw in versions up to 4.2.4. An attacker who can reach the WordPress site can call plugin functions without being logged in and therefore gain access to data or perform actions that should be restricted to administrators. The weakness stems from improper validation of the user's role before executing privileged operations, as identified by CWE‑862. Based on the description, it is inferred that the attack vector is any HTTP request to the plugin's endpoints that does not require authentication.

The vulnerability affects all installations of the Tangible Loops & Logic plugin version 4.2.4 and earlier. Users deploying the plugin through WordPress should check that the installed version is 4.3.0 or later to mitigate the issue. Based on the description, it is inferred that the scope of affected installations is limited to WordPress sites running Loops & Logic plugin version 4.2.4 or earlier.

The CVSS score of 7.5 reflects moderate to high severity due to the lack of authentication. While the EPSS score is not available, the flaw can be exploited by any visitor to the site, making it widely exploitable. The vulnerability is not listed in the CISA KEV catalog, but the potential impact of unauthorized data exposure or modification warrants immediate attention. Attackers can trigger the flaw via standard HTTP requests to the plugin's endpoints without authentication, indicating a low barrier to exploitation. Based on the description, it is inferred that exploitation requires only a standard HTTP request and no privileged access.