The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access controls within the WordPress Strong Testimonials plugin. The flaw enables users who should not have privileged access to perform actions intended only for authorized administrators, such as modifying testimonial content or settings.

The affected vendor is WP Chill, with the Strong Testimonials plugin version 3.3.12 and earlier. All releases up to and including 3.3.12 are impacted. No specific server or operating‑system information is attached to the advisory.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack likely requires access to the WordPress administration interface and may be possible for users who are authenticated with insufficient privileges, or potentially via anonymous access if the plugin’s endpoints are broadly exposed.