A high-severity missing authorization vulnerability in the WP Adminify plugin allows authenticated attackers to bypass intended access controls, potentially leading to unauthorized information disclosure.

This flaw is classified as a missing authorization vulnerability (CWE-862) occurring within the WP Adminify plugin. It allows an authenticated user with low privileges to access functions or data restricted by incorrect access control configurations.

The vulnerability carries a CVSS score of 8.8, indicating a significant risk to the integrity and confidentiality of the WordPress environment. Unauthorized access to administrative settings or plugin data can lead to further system compromise, configuration tampering, or the exposure of sensitive site information, resulting in potential reputational damage and operational disruption.

Immediate Action: Update the WP Adminify plugin to the latest available version that addresses this authorization flaw. If an update is not immediately available, consider deactivating the plugin until a patch is applied.

Proactive Monitoring: Review web server and WordPress access logs for anomalous activity originating from low-privileged user accounts. Specifically, monitor for unexpected requests to administrative endpoints or configuration pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules to detect and block unauthorized access attempts targeting plugin-specific administrative paths.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of access control bypasses, it is critical to address this vulnerability promptly. Administrators should prioritize updating the WP Adminify plugin to the latest version to ensure that authorization checks are correctly enforced, thereby preventing unauthorized exploitation of the plugin's administrative features.