The vulnerability is a missing authorization flaw that allows incorrect access control levels within the Pearl header‑builder plugin. Because the plugin does not properly enforce role checks, a user with any authenticated access to the WordPress admin area could potentially alter, add, or remove header settings that the plugin manages. This weakness corresponds to CWE‑862 – Unchecked Critical Privilege and could lead to unauthorized configuration changes, affecting the appearance or behavior of the site.

WordPress sites that have the Stylemix Pearl header‑builder plugin installed at version 1.3.9 or earlier are affected. The version range reported by the CNA is "from n/a through <= 1.3.9", implying that any installation at those versions is vulnerable.

The CVSS score of 5.4 classifies the issue as moderate in severity. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: any authenticated user with access to the WordPress admin interface, especially those with non‑administrator roles, could exploit the flaw by navigating to the plugin’s configuration screens and modifying settings. No remote code execution or arbitrary file inclusion is described in the current data.