This vulnerability in the Simple Membership plugin by wp.insider is due to missing authorization checks, which can be exploited to bypass intended access control restrictions. The issue affects all versions up to and including 4.6.9. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits are currently in the wild, and no patch or vendor advisory has been provided.

The vulnerability allows an attacker with low privileges to exploit missing authorization controls, potentially leading to unauthorized modification of data or settings within the Simple Membership plugin. There is no impact on data confidentiality or system availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the Simple Membership plugin to minimize exposure. Monitor for vendor updates or patches addressing this issue.