A critical missing authorization flaw in the SALESmanago and Leadoo plugin exposes systems to unauthorized access due to improper access control configurations.

This is a missing authorization vulnerability (CWE-862) triggered by the lack of proper capability checks in the plugin, allowing unauthenticated remote attackers to manipulate access control settings.

The exploitation of this vulnerability permits unauthorized modification of access control levels, which may lead to privilege escalation or unauthorized data exposure. Given the CVSS score of 8.8, this represents a significant security risk that could compromise the integrity of the entire WordPress environment and the sensitive marketing data managed by the platform.

Immediate Action: Update the SALESmanago and Leadoo plugin to a version beyond 3.9.0 as soon as the vendor provides a patch, or deactivate the plugin if immediate updates are unavailable.

Proactive Monitoring: Review system access logs for unusual administrative activity or unexpected changes to user role configurations.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the plugin's administrative endpoints.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability poses a high risk to organizational security due to the lack of required authentication for sensitive access control operations. Administrators should prioritize monitoring for any unauthorized configuration changes and ensure the plugin is updated immediately upon the release of a security fix from the vendor.