The vulnerability is a missing authorization flaw in WordPress Strong Testimonials that allows actors to exploit incorrectly configured access levels, enabling actions beyond the intended permissions. An attacker can use the flaw to perform privileged operations such as creating, editing, or deleting testimonials, or otherwise manipulating content that the site’s administrators would normally protect. The weakness is identified as CWE‑862.

The issue impacts the WordPress Strong Testimonials plugin provided by WP Chill. Any WordPress installation running a version of the plugin from the initial release up through 3.3.14 is affected. No other WordPress components are listed as affected in the CVE.

The CVSS score of 4.3 indicates a moderate risk of exploitation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector involves interaction with plugin interfaces that bypass normal permission checks, giving an attacker the ability to perform unauthorized operations without needing elevated privileges. The absence of an exploit probability rating means the threat remains largely theoretical unless the plugin is exposed to attackers via an authenticated or unauthenticated web interface.