The CVE describes a missing authorization flaw in PickPlugins Testimonial Slider that allows an attacker to exploit improperly configured access control settings. This flaw enables unauthorized users to create, edit, or delete testimonial entries that are displayed on a website, potentially resulting in defacement, spam injection, or removal of legitimate content. The weakness is classified as improper authorization (CWE‑862).

All installations of PickPlugins Testimonial Slider using version 2.0.15 or earlier are affected. Any WordPress site that has this plugin installed and its access controls not properly restricted is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack likely involves sending requests to the plugin’s functionality through the WordPress admin area or any exposed endpoints that lack proper authorization checks; this inference is based on the description of a broken access control mechanism. No specific exploit code or privilege escalation path is disclosed in the CVE payload.