The vulnerability is a missing authorization flaw that allows users to bypass the intended security controls of the Lottier for WPBakery WordPress plugin. Because the plugin does not verify proper user privileges before performing certain operations, an attacker can perform unauthorized modifications, such as changing animation settings, injecting custom scripts, or accessing sensitive data stored within the plugin. These actions can undermine the integrity of website content and potentially expose confidential information.

All installations of the Lottier for WPBakery plugin by merkulove that are running version 1.1.7 or earlier. This applies to any WordPress site that has the plugin installed and has not upgraded beyond the stated version.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely involve an attacker with access to a WordPress account that can install or configure plugins, or an attacker who compromises a user account. Once authenticated, the attacker can exploit the broken access controls to modify plugin behavior or obtain data that should be restricted. Due to the missing authorization check, no additional software or hardware prerequisites are mentioned, so the attack vector is primarily through the WordPress administration interface.