The vulnerability is a missing authorization flaw in the Blend Media WordPress CTA easy‑sticky‑sidebar plugin. It allows users with insufficient privileges to perform actions normally reserved for administrators, potentially leading to unauthorized viewing or modification of content, or other administrative functions. The weakness is a classic broken access control issue, exposing the confidentiality and integrity of site data.

All versions of the Blend Media WordPress CTA plugin through 2.1.2 are affected. Site administrators who have installed or are using any of these versions may be vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through the WordPress admin interface, where a user with standard permissions can access the plugin configuration pages and exploit the incorrect authorization checks. The flaw could be leveraged by any authenticated user that can reach the plugin settings, allowing them to gain elevated privileges or alter protected content.