WPZOOM Portfolio Lite before version 1.4.34 does not verify that a user is authorized to edit a post before changing its type and order, allowing users with the contributor role and above to hijack any other user’s posts or pages. This flaw, classified as CWE‑639, lets an attacker convert unrelated content into portfolio items, removing it from its original listings and URLs and potentially confusing site visitors by altering the public presentation.

WordPress sites that have installed WPZOOM Portfolio Lite versions prior to 1.4.34 are affected. Any site using this plugin should check the installed version and verify that it is less than 1.4.34.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score is < 1%, suggesting a low exploitation probability. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated request to the plugin’s edit endpoint, which the plugin fails to restrict by author or role. An attacker with contributor or higher privileges could exploit this IDOR to alter unrelated content.