The AllAble Connector plugin for WordPress (versions 0.13.4 and earlier) contains a subscriber broken access control flaw (CWE‑862). It allows an attacker who can authenticate as a subscriber to bypass normal role checks, potentially performing privileged actions such as accessing sensitive data or modifying site settings. This weakness could lead to confidentiality or integrity violations for users who are not supposed to have those permissions.

The vulnerable product is the AllAble Connector plugin from Flexyma, available for WordPress sites. Versions up to and including 0.13.4 are affected. All installations of these versions running on WordPress are at risk.

The CVSS base score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an authenticated subscriber to interact with the plugin, implying local access to the WordPress installation. If the plugin's role checks are bypassed, privilege escalation is possible, allowing the attacker to perform privileged actions on the affected site.