The vulnerability is a broken access control that allows unauthorized users to access functionality not properly constrained by access control lists within the Unlimited Timeline plugin. This flaw could let an attacker view or manipulate data that should only be available to privileged users, potentially leading to data disclosure or modification. The weakness corresponds to CWE‑862: Missing Authorization.

The insecure behavior exists in the WordPress plugin Unlimited Timeline developed by NotFound. All released versions prior to 1.6.1 are impacted. Exact version ranges are not explicitly enumerated beyond the upper bound of 1.6.1, so any version installed that is lower than 1.6.1 should be considered vulnerable.

The CVSS score of 7.5 indicates high severity, while the EPSS value of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by sending crafted requests through the web interface, assuming they can identify the relevant endpoints. Although the exploitation window is small, the impact of unauthorized access warrants prompt remediation.