The vulnerability is a missing authorization flaw in the FolioVision FV Simpler SEO WordPress plugin, allowing attackers to bypass intended access restrictions. Exploiting the incorrectly configured security levels, an attacker could access or modify data and settings that should be protected, potentially leading to further compromise of the WordPress site or escalation to administrative privileges. This weakness is identified as CWE-862, which highlights the failure to verify an entity's authorization before granting access to resources.

FolioVision FV Simpler SEO plugin versions up to and including 1.9.6 are affected. Users of this plugin on any WordPress website remain vulnerable until the plugin is updated to a later version.

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score of less than 1% suggests very low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, reducing immediate threat perception. The most plausible attack vector is remote via the web, with an attacker sending crafted requests to plugin endpoints that lack proper authorization checks. Successful exploitation would require that the attacker can reach the WordPress administration area or the plugin’s exposed interfaces. After verification, the attacker could gain unauthorized data access or perform privileged operations within the WordPress site.