The side doornobody locked.
Your login page checks who you are. This flaw is a part of the software that forgets to, so someone can do an administrator's job without being one.
What it is
Every action in the software should check two things: who is asking, and whether they are allowed. Usually the main screens do. The flaw is somewhere that was missed, such as a button's background request or an add on feature, which does what it is asked by anyone.
What could happen to your site
It depends on what the unchecked part does. Often it is changing a setting, seeing other people's orders or messages, or giving an ordinary account administrator rights. Sometimes it is enough to take the site over.
How likely it is
One of the commonest flaws in WordPress plugins, and top of the list of web security risks kept by OWASP, the open web security project. Many need any account on the site, even a customer account, which matters if your site lets anyone sign up.
How it gets fixed
The software is changed to check who is asking before it does anything. For you, the fix is the update. If your site lets people make accounts, it is worth checking no one has been given more rights than they should have.
What to ask your developer
Send whoever looks after your site this:
Ask your developer“The Mendbird report says some of our software is missing a check on who can do what. Can you update it, and make sure no accounts have more rights than they should?”