The vulnerability is a missing authorization flaw in the Dashboard Widget Sidebar plugin caused by incorrectly configured access control security levels. It can allow users who do not have permission to access certain dashboard features, potentially exposing sensitive configuration data or permitting unauthorized modifications.

All versions of Morten Dalgaard Johansen’s Dashboard Widget Sidebar plugin up through 1.2.3 are affected.

The CVSS score of 4.3 indicates a moderate risk level, while the EPSS score of less than 1% suggests that exploitation is currently not a common occurrence. The plugin is not listed in the CISA KEV catalog. The likely attack vector is remote, wherein an attacker may craft requests to the plugin’s exposed endpoints to bypass the intended role checks. A successful exploitation would provide unauthorized access to dashboard operations, leading to potential data exposure or configuration changes.