The vulnerability stems from an Incorrect Privilege Assignment flaw in the GoodLayers Core WordPress plugin. The flaw allows an attacker to elevate privileges beyond what is intended for a given user, thereby compromising the integrity and control over the site. This type of weakness is classified as CWE‑266, improper authorization.

GoodLayers Core plugin for WordPress is affected. All versions earlier than 2.1.7 are vulnerable; no sub‑version granularity is provided beyond the upper bound of 2.1.7.

The CVSS score of 8.8 identifies the flaw as high severity. The EPSS score of less than 1 % indicates a low likelihood of exploitation at present. The vulnerability does not appear in the CISA KEV catalog. The likely attack vector involves interacting with the plugin from within the WordPress environment, such as a user account with access to the plugin’s settings, but the CVE description does not specify the exact method of exploitation.