This vulnerability in Upqode Plum: Spin Wheel & Email Pop-up (up to version 2.0) is classified as CWE-862 (Missing Authorization). It permits unauthorized users to access functionality that is not properly constrained by ACLs, potentially leading to unauthorized actions. The issue also includes stored XSS, which can be used to inject malicious scripts that persist in the application. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with a scope change and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to perform unauthorized actions within the affected plugin, potentially leading to data exposure or modification due to the stored XSS component. The vulnerability impacts confidentiality, integrity, and availability of the system where the plugin is installed. However, there are no reports of active exploitation in the wild.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.