Technical impact
The vulnerability is a missing authorization check in the NextMove Lite plugin, which permits users to invoke privileged functions without proper authentication. This can lead to unauthorized modifications or data exposure within the WordPress site. According to the CWE reference, it is a classic case of Broken Access Control (CWE-862). No denial‑of‑service effect is reported.
Affected Systems
The flaw is present in all releases of XLPlugins NextMove Lite up through version 2.23.0, including earlier snapshots. WordPress sites that have the NextMove Lite plugin installed within that version range are affected.
Risk and Exploitability
The CVSS score of 7.5 signals a high severity. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path, as suggested by the description, involves a web request to one of the plugin’s endpoints that bypasses normal WordPress permission checks. It is inferred that the attacker may need some level of WordPress access to exploit the vulnerability, but the CVE description does not explicitly state the required privileges or exact attack vector.
