This vulnerability is a missing authorization flaw in the Greenshift WordPress plugin, allowing an unauthenticated or low‑privileged user to bypass the intended access controls and gain unauthorized access to features normally restricted by plugin settings. The impact is that an attacker could potentially manipulate or view content, modify settings, or otherwise perform actions that should be limited to privileged users.

The issue affects the wpsoul Greenshift animation and page builder block plugin for WordPress up to version 12.1.1. Any WordPress site that is running this plugin or an earlier unpatched version is susceptible.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, using the plugin's administrative interface or misconfigured configuration pages that are accessible without proper role verification, exploiting the missing authorization check.