The vulnerability is a missing authorization mechanism in the WordLift plugin that allows attackers to exploit incorrectly configured access control security levels. Because the plugin fails to enforce proper user permissions, an attacker can access privileged functions and manipulate the plugin’s behavior. This flaw could lead to unauthorized data exposure or content modification, compromising the integrity of the site.

WordLift plugin for WordPress, versions from the earliest release up through version 3.54.4. Any WordPress installation that has WordLift installed and has not upgraded beyond 3.54.4 is potentially affected.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker who has some level of access to the WordPress site, such as a user with contributor or author privileges, exploiting the plugin’s exposed management pages to gain unauthorized privilege. Because the flaw is an access control issue rather than a remote code execution bug, the attack would require the attacker to interact with the WordPress backend or plugin interfaces.