The Strong Testimonials plugin for WordPress contains a missing capability check in its 'edit_rating' function. This flaw allows any authenticated user with Contributor-level access to modify or delete the rating meta on any testimonial post, regardless of ownership. The vulnerability is classified as a missing authorization (CWE‑862) and directly compromises the integrity of testimonial ratings, potentially skewing displayed data and misleading site visitors.

All installations of the Strong Testimonials plugin up to and including version 3.2.18 are affected. The impact is limited to the WordPress plugin and does not extend to the core CMS or other plugins.

The CVSS score of 4.3 indicates moderate severity, primarily due to the limited scope of the flaw and the need for authenticated access. The EPSS score of less than 1% suggests that the probability of exploitation in the wild is very low at present, and the vulnerability is not listed in CISA's KEV catalog. However, the attack vector requires only a valid WordPress nonce, which can be obtained from a contributor's own testimonial edit screen, making the exploitation path straightforward for attackers who already have Contributor or higher privileges. Consequently, sites with exposed Contributor roles are at low to moderate risk of data integrity compromise.