The vulnerability is a missing authorization check in Mohammed Kaludi Core Web Vitals & PageSpeed Booster, allowing an attacker to exploit incorrectly configured access control. This flaw can enable a user with insufficient privileges to perform privileged actions within the plugin, potentially changing settings or revealing information. The weakness is classified as CWE-862, indicating a missing authorization defect.

WordPress users running the Core Web Vitals & PageSpeed Booster plugin from the first release up to and including version 1.0.28 are impacted; all earlier builds are affected and newer releases beyond 1.0.28 are assumed to have the remedy.

The CVSS score of 5.4 places the issue in the moderate range, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Likely exploitation would occur via the web interface by a user who has standard access to the plugin. No elevated privilege or user compromises are required beyond the standard access level to the plugin configuration.