This vulnerability is a missing‑authorization flaw that permits the attacker to modify any "MaxiBlocks" option without a proper permission check. The impact is that a user who can reach the option‑update endpoint is able to alter the plugin’s configuration, thereby granting themselves higher privileges or changing site behavior in a way that was not intended. The description explicitly states the missing authorization, and the identified CWE (CWE-862) confirms a lack of privilege checks in the affected code.

Christiaan Pieterse’s MaxiBlocks WordPress plugin is affected in all releases from the original version through 2.1.0. Users running any of these versions should determine their installed version and seek a newer release if one is available.

The CVSS score of 8.8 denotes a high‑severity weakness and the EPSS score of less than 1% indicates that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description and typical WordPress plugin access patterns, it is inferred that an authenticated user with a role lower than administrator can reach the option‑update endpoint and perform the privilege escalation; no external attack surface beyond legitimate WordPress access is required.