Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks allows an attacker to exploit incorrectly configured access control security levels, potentially permitting unauthorized access to plugin settings or features. This flaw gives a threat actor the ability to modify plugin behavior or retrieve configuration data without proper authorization. The weakness is an Authorization bypass (CWE‑862).

The vulnerability affects all installations of the eLightUp Falcon – WordPress Optimizations & Tweaks plugin version 2.12.0 and earlier on WordPress sites. Any WordPress site using this plugin has the issue, regardless of the WordPress core version.

The CVSS score of 5.3 indicates moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface, where an unauthenticated or low‑privilege user can send crafted requests to privileged plugin endpoints. Exploitation requires only network accessibility to the WordPress site and does not rely on additional privileges.