The vulnerability is a missing authorization flaw in slui Media Hygiene that allows an attacker to access media hygiene functions without proper authentication. This flaw can let users view, modify, or delete media tasks and settings, compromising the integrity of the media library. The weakness aligns with CWE-862, where access controls are not validated before execution.

The issue affects slui Media Hygiene plugin versions from the earliest available release through 4.0.1. Administrators using a version dated 4.0.1 or older are at risk. No other products are listed as affected.

The CVSS vector assigns a score of 4.3, indicating a moderate impact. The EPSS score of less than 1% suggests that exploitation likelihood is low. The vulnerability is not included in the CISA KEV catalog, implying no known exploits in the wild. Likely attack vectors involve authenticated or unauthenticated users exploiting incorrectly configured access control. Based on the description, it is inferred that the attacker would need only to discover the plugin’s URLs, with no need for additional privileges. The exploitation requirement is minimal, requiring only knowledge of the plugin’s URLs and lack of authorization checks.