This vulnerability in the mahabub81 User Roles and Capabilities plugin arises from missing authorization controls, enabling attackers with limited privileges to exploit access control misconfigurations. It affects all versions up to and including 1.2.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, and no integrity or availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The impact is limited to partial confidentiality loss due to missing authorization checks in the plugin. There is no reported impact on integrity or availability. Attackers with some privileges may gain unauthorized access to certain capabilities or data within the affected plugin, but the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations related to the User Roles and Capabilities plugin to minimize exposure. Monitor for vendor updates or security advisories addressing this vulnerability.