The Maspik WordPress plugin version 2.5.6 and prior suffers from a missing authorization vulnerability (CWE-862) in the Maspik_spamlog_download_csv function. This function lacks proper capability checks, allowing authenticated users with low-level privileges (subscriber and above) to export and download the spam log database. The spam log may contain sensitive information from blocked submission attempts, including legitimate submissions that were misclassified as spam. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and network attack vector but limited confidentiality impact and no integrity or availability impact. No patch or official remediation has been documented in the provided data.

An attacker with subscriber-level access or higher can export the spam log database, potentially gaining access to sensitive data contained within blocked submission attempts. This exposure could lead to information disclosure of legitimate user data mistakenly flagged as spam. There is no direct impact on system integrity or availability. The vulnerability requires authenticated access, limiting the attack surface to users with at least subscriber privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and consider disabling or limiting the use of the spam log export functionality if possible. Monitor for updates from the vendor yonifre regarding patches or official mitigations.