This vulnerability in the 'Send Emails with Mandrill' plugin arises from missing authorization checks caused by improperly configured access control. It affects all versions up to and including 1.4.1. The issue allows users with some privileges to bypass intended access restrictions, potentially enabling unauthorized sending of emails. The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, but no user interaction. The impact is limited to confidentiality with no integrity or availability impact. No patch or official remediation information is currently available.

The vulnerability could allow an attacker with low privileges to send emails via the plugin without proper authorization, potentially leading to limited information disclosure or misuse of the email sending functionality. There is no indication of impact on data integrity or system availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality to trusted users only and monitor for unusual email sending activity related to this plugin.