The vulnerability is a missing authorization check in the Salient Core plugin. The flaw allows a user with insufficient privileges to perform actions that should be protected, potentially letting them modify, delete, or view sensitive content. The weakness corresponds to CWE‑862 and can affect both confidentiality and integrity of the WordPress site. The official CVE document does not specify whether an attacker must be logged in, but the wording suggests that incorrect access control settings could let unprivileged users act. The impact is moderate, with a CVSS score of 4.3.

Affected products include the Salient Core plugin from ThemeNectar. All installations running version 3.0.8 or earlier are vulnerable, regardless of the WordPress core version. The issue is listed through "n/a through <= 3.0.8", meaning any release up to 3.0.8 is affected.

The EPSS score is less than 1%, indicating a minimal likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.3 classifies it as a medium severity. The likely attack vector involves interaction with the WordPress site, likely through a web request that bypasses the plugin’s authorization checks. Because the flaw exists in plugin code, exploitation would require the ability to send crafted requests to the affected plugin endpoints.