A missing authorization check in the Jegstudio Gutenverse plugin allows an attacker to bypass intended access controls and manipulate its configuration. The flaw enables the alteration of plugin settings and potentially other WordPress content managed through Gutenverse. This creates a risk of unauthorized changes, impacting the integrity of site content and the overall security posture.

WordPress installations running Jegstudio Gutenverse plugin version 3.2.1 or earlier are affected. The vulnerability does not involve core WordPress components but any site with the plugin installed could be compromised.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation as of the latest data, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user, or an attacker who gains local or remote access to a WordPress admin interface, taking advantage of the plugin’s improper access‑control configuration. Once authenticated, the attacker can modify plugin settings without the necessary permissions, leading to elevated privileges within the plugin's domain.