The vulnerability is an Authorization bypass through a user‑controlled key, allowing an attacker to access administrative functions of the WP Logo Showcase Responsive Slider and Carousel plugin that should be restricted to privileged users. The weakness is categorized as CWE‑639. If exploited, the attacker could modify, delete, or create content managed by the plugin, potentially leading to data integrity compromise and altering the site’s appearance or functionality.

This issue affects the Essential Plugin WP Logo Showcase Responsive Slider and Carousel. All installations of the plugin from the earliest release up to and including version 3.6 are vulnerable; 3.7 and newer contain the fix.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, so current exploitation likelihood cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, originating from a web request that supplies a crafted key to the plugin’s administration interface, thereby bypassing normal access controls.