The vulnerability is a missing authorization flaw in the Premium Blocks – Gutenberg Blocks for WordPress plugin that lets a user perform actions or access features beyond their intended permission level. Exploiting this flaw can allow an attacker to manipulate block settings, upload or edit content, or otherwise use the plugin’s features without proper authentication checks, compromising the integrity of site content. The weakness is classified as CWE‑862, indicating a security flaw where the system fails to check access rights before allowing operations.

Vulnerable versions of the LeapWorx plugin are those up to and including 2.3.18. Any WordPress installation that has Premium Blocks – Gutenberg Blocks for WordPress version 2.3.18 or older is potentially impacted and should review the installed plugin version and upgrade accordingly.

The CVSS score of 5.3 rates this as a moderate severity issue, and the lack of an EPSS score indicates no publicly known exploitation statistics are available. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not publicly exploited at large scale. The most likely attack vector is via authenticated access to the plugin’s administrative interface, but it could also be traversed by unauthenticated users if the plugin exposes any endpoints. The risk to systems is an unauthorized escalation of privileges that can lead to content tampering or data leakage.