Team EUVD-2026-15623

Remote unauthenticated attacker can exploit RadiusTheme Team plugin versions <= 5.0.11 with default configurations. No special conditions required—default access control settings are misconfigured, allowing unauthorized data access without authentication or user interaction.

Risk assessment is constrained by missing CVSS vector and EPSS data, but the vulnerability is clearly significant given its classification as a broken access control issue (CWE-862), which consistently ranks among the OWASP Top 10 and is highly exploitable in web applications. The absence of a public CVSS score and KEV/CISA status suggests this may be a recently disclosed or lower-profile vulnerability. However, missing authorization flaws in WordPress plugins typically have high real-world impact because they often affect multi-tenant or multi-user environments, and WordPress sites are ubiquitous attack targets. The attack vector is likely network-based and low-complexity (likely no authentication required or trivial authentication bypass). Without EPSS or POC data, exploitation probability cannot be quantified, but given the simplicity of testing authorization flaws and the popularity of WordPress, the practical risk is moderate to high for affected installations. Organizations should prioritize this based on deployment footprint: a widely-installed plugin with this flaw poses greater risk than a niche plugin.

An attacker discovers that the Team plugin fails to validate user permissions on sensitive API endpoints or admin functions. The attacker crafts a request (likely via direct HTTP POST or REST API call with no authentication or minimal spoofed credentials) to access or modify team member data, settings, or administrative features normally restricted to site administrators. Due to the missing authorization check, the request succeeds, allowing the attacker to view sensitive information, modify team structures, elevate privileges, or disrupt site operations. No complex exploitation technique or privilege escalation chain is required; the authorization flaw is directly exploitable through standard HTTP requests, making automated exploitation likely.