The vulnerability is a missing authorization flaw in the LeapWorx Premium Blocks – Gutenberg Blocks for WordPress plugin that allows attackers to exploit incorrectly configured access control settings, classified as CWE‑862, which can enable unauthorized users to gain elevated access to the plugin’s features and potentially compromise the website’s integrity and expose sensitive data.

LeapWorx’s Premium Blocks – Gutenberg Blocks for WordPress plugin is affected on all versions from the initial release up to and including 2.3.18; any WordPress site running any of those plugin versions is at risk.

The CVSS score of 5.3 indicates a medium severity, with no publicly reported exploits yet (EPSS not available) and it is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. The likely attack vector is a user with access to the WordPress administration area who can interact with the plugin, as the flaw arises from misconfigured permissions; an attacker could exploit this to bypass intended restrictions and gain unauthorized actions within the plugin.