This vulnerability in Campaign Monitor for WordPress arises from missing authorization checks, classified under CWE-862. It allows users with some level of privilege to bypass intended access controls, potentially performing actions beyond their authorization scope. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited impact on integrity without affecting confidentiality or availability. The affected versions include all versions up to 2.9.1. No patch or official fix information is provided at this time.

The vulnerability could allow an attacker with limited privileges to perform unauthorized actions within the Campaign Monitor for WordPress plugin, potentially modifying or interfering with campaign configurations or data integrity. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review user privileges carefully and restrict access to trusted users only. Monitor for updates from Campaign Monitor regarding patches or official mitigations.