This vulnerability in the WordLift plugin for WordPress arises from missing authorization checks, allowing an attacker to bypass intended security restrictions. The flaw can enable any user who can reach the affected endpoints to perform privileged operations, potentially altering or deleting content, accessing restricted data, or manipulating site settings. The referenced CWE-862 highlights the weakness in access control mechanisms that can compromise confidentiality, integrity, or availability of the website's data and configuration.

Any WordPress installation using WordLift versions up to and including 3.54.15 is impacted. The plugin is distributed by WordLift Srl and is commonly embedded in blogs and commercial sites to enhance search relevance and marketing insights. Users on older versions of the plugin that have not applied subsequent updates are susceptible to exploitation.

The CVSS score of 5.4 indicates a moderate severity level. The EPSS score of less than 1% suggests a low but nonzero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been confirmed as widely exploited. The likely attack vector is an HTTP-based request to the plugin's internal administrative endpoints, which is inferred from the nature of an access control bypass and the typical deployment of WordLift on public WordPress sites.