The vulnerability is a missing authorization flaw in the GS Testimonial Slider WordPress plugin. Because access control levels are incorrectly configured, an attacker can potentially perform actions that should be restricted, leading to unauthorized reading or modification of testimonial content or configuration. The weakness is classified under CWE-862, which concerns improper authorization checks.

GS Plugins’ GS Testimonial Slider plugin for WordPress is affected through version 3.3.0 and earlier. Any installation of the plugin that has not been updated beyond 3.3.0 is vulnerable. The issue appears to apply to all releases from the earliest available version up to the specified cutoff.

The CVSS score of 4.3 indicates moderate severity. EPSS is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation would involve a web-based attack that bypasses access control checks, possibly through crafted HTTP requests to the plugin’s endpoints. The attack vector is inferred based on the nature of the plugin and the missing authorization claim, but the precise prerequisites are not detailed in the available data.