VillaTheme Lookzy Woo-lookbook plugins up to version 1.1.14 contain a missing authorization flaw that permits users to perform actions beyond their permitted level. This weakness is defined as CWE‑862, indicating that authentication controls may be bypassed or ignored. The vulnerability enables attackers to manipulate protected resources or execute arbitrary operations, potentially compromising the confidentiality, integrity, or availability of the WordPress site where the plugin is installed.

Any WordPress installation deploying the Lookzy Woo-lookbook plugin version 1.1.14 or earlier is susceptible, including all versions from the initial release up through 1.1.14. The affected product is the VillaTheme Lookzy wizard book plugin, noted by the CNA as Lookzy.

The CVSS score of 6.5 suggests moderate severity, and although an EPSS score is not provided, the lack of KEV listing indicates no known exploitation yet. The most likely attack route is subsequent to user authentication; the flaw permits escalation of privileges by accessing administrative functions without proper checks. Given the moderate CVSS, the risk is significant enough to warrant prompt remediation but may not indicate imminent widespread exploitation.