The vulnerability is a missing authorization flaw that lets an attacker bypass incorrectly configured access control settings in the WordPress Strong Testimonials plugin. Classified as a CWE‑862 "Missing Authorization", the CVE description does not specify the required attacker privilege level, so it is unclear whether an unauthenticated or low‑privilege user can fully exploit the vulnerability. However, the flaw could allow unauthorized manipulation of testimonial content if exploited.

The affected product is the WordPress Strong Testimonials plugin provided by WP Chill. All releases up to and including version 3.3.12 are impacted; any installation using a version earlier than 3.3.13 inherits this broken access control.

The CVSS score for this issue is 4.3, indicating moderate risk, and the EPSS score is listed as < 1 %, showing a very low expected exploitation probability. It is not included in the CISA KEV catalog. Based on the description, the likelihood of exploitation is via web requests to the plugin’s administrative or public interfaces, where an attacker could craft requests to access restricted testimonial data. While the probability is low, an attacker could potentially use the flaw to make unauthorized changes or disclose content, so mitigation is recommended.