The vulnerability is an External Control of Assumed-Immutable Web Parameter flaw that permits an attacker to modify data the application assumes to be immutable. This flaw can lead to unauthorized changes to data or configuration within the WordPress Salevo plugin, potentially enabling privilege escalation or other unauthorized operations. The weakness is classified as CWE-472, indicating insufficient control over immutable assumptions.

The issue affects the VillaTheme Salevo Woo‑Boost‑Sales WordPress plugin up to version 1.3.0. Any WordPress site that has this plugin installed and runs a vulnerable version is exposed to the flaw.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to send crafted web requests to the plugin’s endpoints, which could be performed by an authenticated user or by users with sufficient site access. The exploitation could result in the alteration of data, disclosure of restricted information, or execution of actions normally protected by the plugin.