This vulnerability is a missing authorization flaw that allows an attacker to perform actions normally restricted to higher‑privileged users. The weakness lets an unauthorized or minimally privileged user potentially read or modify content beyond their intended scope, increasing confidentiality and integrity risk. The weakness is identified as CWE‑862, a classic broken access control issue.

The Lottier Gutenberg plugin for WordPress by merkulove is affected, version 1.1.1 and earlier. The vulnerability applies to all installations of the plugin where the default access control has not been reconfigured to restrict operation levels.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is under 1 %, meaning the exploitation probability is low at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through an authenticated session or a user with limited privileges; an attacker would need to discover a user account or otherwise gain access, then exploit the missing authorization check to elevate privileges within the context of the plugin’s functionality.