This vulnerability is a missing authorization flaw in the SiteLock Security plugin for WordPress, allowing users to bypass intended access controls due to incorrectly configured security levels. Exploiting this issue can result in unauthorized modification of plugin settings, potentially compromising the security posture of the affected site. The weakness is classified as CWE-862, which denotes a missing privilege or access control error.

The affected product is SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans, a WordPress plugin, with vulnerable versions up to and including 5.0.1. Any WordPress site using a version of the plugin in this range is susceptible.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation in the wild. The vulnerability does not appear in the CISA KEV catalog. Based on the description it is inferred that the attack vector is via the WordPress admin interface, requiring attacker access to a privileged account or exploitation of default credentials. Given the low EPSS, the risk is moderate but should still be addressed promptly.