This vulnerability is a missing authorization flaw that can allow an attacker to bypass the intended access controls of the Highlight and Share plugin. By exploiting incorrectly configured security levels, a user who is not normally permitted can gain access to functionalities or data that should be restricted. The weakness is registered as CWE‑862, indicating that the system fails to enforce appropriate privilege checks, potentially impacting confidentiality and integrity of plugin data and actions.

The vulnerability affects the Highlight and Share WordPress plugin developed by Ronald Huereca, including all released versions up to and including 5.2.0. Users with installations of these versions are susceptible unless they have applied a later fix or otherwise restricted plugin access.

The CVSS score of 4.7 places this issue in the moderate risk range, while the EPSS score of 2% suggests a modest likelihood of exploitation in the wild. It is not currently listed in the CISA KEV catalog. The likely attack vector is through a web request to the plugin’s endpoints, which an attacker can manipulate to override normal access checks. Successful exploitation would allow the attacker to read or modify plugin data that is otherwise protected.