The Voidek Employee Portal plugin for WordPress suffers from a missing capability check on several AJAX endpoints in all versions up to 1.0.7, classified as CWE-862 (Missing Authorization). This flaw enables unauthenticated attackers to perform sensitive actions such as account registration, user deletion, and modification of employee portal data without proper permissions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates.

An attacker can exploit this vulnerability to perform unauthorized actions within the Voidek Employee Portal, including creating accounts, deleting users, and altering employee information. This compromises the integrity of the portal's data and user management functions. The vulnerability does not affect confidentiality or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's AJAX endpoints through web application firewalls or other access controls where possible. Monitor for vendor updates and apply patches promptly once available.