The SeedProd Website Builder plugin contains a missing capability check in the seedprod_lite_get_revisisons function, allowing any authenticated user with Subscriber level or higher to retrieve the full content of any landing page revision. This flaw exposes the confidential content of landing page revisions, representing a moderate confidentiality impact. The weakness is a classic access control violation (CWE-862).

The vulnerability affects the WordPress plugin "Website Builder by SeedProd – Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode" for all releases up to and including 6.18.15. Users of any of those versions should plan an upgrade.

The flaw requires authenticated access; an attacker needs at least Subscriber role, so it is not publicly exploitable but can be abused by compromised accounts or insiders. The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Risk is therefore moderate, primarily from potential accidental or malicious data exposure by legitimate users.