The flaw is a missing authorization issue in the Revive.so plugin that allows any user who can send a request to the plugin’s endpoints to perform actions that should be restricted. This missing authorization opens the door for an attacker to manipulate content or settings controlled by the plugin, potentially compromising the integrity of the site’s data. The weakness aligns with CWE‑862: Missing Authorization. Because the vulnerability operates within the plugin’s scope, the direct impact is limited to the features the plugin provides, but an attacker could leverage it to subvert media management or editorial workflows.

WordPress installations running the Revive.so plugin from WP Chill. Versions from the earliest releases up through 2.0.3 of the plugin are vulnerable. Site owners using any of these versions should consider the plugin's risk level.

The CVSS score of 4.3 indicates a low‑moderate potential for damage. EPSS of less than 1 % points to a very low probability that this flaw is actively exploited. The vulnerability is inferred to be exploitable via web requests to the plugin’s control endpoints, potentially requiring an authenticated session or a misconfigured permission set. Because the flaw is simple access‑control bypass, the attack vector is likely remote and requires no advanced prerequisites. No known public exploits exist and the vulnerability is not listed in CISA’s KEV catalog.