The vulnerability is a missing authorization flaw that allows an attacker to access and manipulate the Better Business Reviews plugin without proper permissions. This was identified as CWE‑862, indicating a lack of access control checks. An attacker who reaches the affected functionality could read, edit, or delete review data, potentially compromising the integrity and confidentiality of business review information stored in the WordPress database.

All installations of BBR Plugins Better Business Reviews up to and including version 0.1.1 are vulnerable. The issue applies to every site that has deployed this plugin version, without regard to additional configuration or external controls.

The CVSS score of 5.4 places the issue in the medium severity range, and the EPSS score of less than 1% suggests that widespread exploitation is currently uncommon. Because the vulnerability is accessed via the plugin’s web interface, any publicly reachable WordPress site that has not been patched can be exploited by an unauthenticated actor. The plugin’s functionality is not restricted by any external authentication layer, so the attack surface is relatively high. Even though the exploit probability is low, the potential impact to business review data warrants prompt attention.