An authorization bypass vulnerability in the FleekDash V2 WordPress plugin allows authenticated users to perform unauthorized actions, posing a high risk to site integrity.

This is a missing authorization vulnerability (CWE-862) located within the UserController component. It allows an attacker with low-level authenticated access to perform actions that should be restricted to higher-privilege users.

With a CVSS score of 8.8, this vulnerability presents a high risk for unauthorized data modification or administrative control over the WordPress instance. If exploited, attackers could compromise sensitive site data or disrupt operations, leading to significant reputational and operational damage.

Immediate Action: Update the FleekDash V2 plugin to the latest available version as provided by the vendor. If no update is currently available, deactivate and remove the plugin until a secure version is released.

Proactive Monitoring: Audit WordPress user activity logs for suspicious requests originating from low-privilege accounts, specifically targeting the UserController endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable plugin controllers.

Public Exploit Available: No (exploit_available: false)

The missing authorization check in the UserController allows for significant privilege escalation. Security teams must ensure that the plugin is updated immediately or disabled to prevent potential exploitation of these critical site management functions.