The vulnerability is a missing authorization flaw in the wpWax Legal Pages plugin that permits incorrect access level configuration to be exploited. An attacker can gain unauthorized access to protected legal page content or settings, potentially modifying or exposing sensitive information. The core weakness is reflected as CWE‑862, indicating a failure to enforce proper privilege checks.

WordPress sites running the wpWax Legal Pages plugin version 1.4.6 or earlier. The issue spans all installations of this plugin in those versions, regardless of WordPress version.

The CVSS score of 5.3 indicates a moderate impact risk. The associated EPSS score of less than 1% suggests a low likelihood of exploitation in the current environment. The vulnerability is not listed in CISA KEV. Exploitation requires access to the WordPress site’s web interface; the likely attack vector is an authenticated user with permissions insufficiently checked by the plugin. Based on the description, it is inferred that any authenticated WordPress user may trigger the flaw without additional privilege escalation.