A broken access control flaw allows an attacker to leverage incorrectly configured security levels in the WP-Lister Lite for Amazon plugin. This vulnerability can let an unauthenticated or low‑privilege user gain elevated privileges within WordPress, enabling unauthorized manipulation of plugin settings or data. The core weakness is identified as CWE‑862, a lack of proper authorization checks, which directly threatens confidentiality and integrity of site data without affecting availability.

The flaw affects the WP Lab WP‑Lister Lite for Amazon plugin for WordPress, versions up to and including 2.9.2. Hosts running these versions should verify installed plugin versions and identify any instances where the plugin is present.

The CVSS score of 5.3 indicates a medium severity impact. No EPSS score is available, so precise exploitation likelihood is uncertain; however, the lack of known KEV listing means no known public exploits are documented. The vulnerability can be exploited by crafting requests that bypass standard authorization checks, typically without requiring existing credentials, making it feasible for attackers to target any site running a vulnerable plugin version.