The SiteLock Security – WP Hardening, Login Security & Malware Scans plugin contains a missing authorization flaw that lets attackers bypass the plugin’s configured security levels. Classified as CWE‑862, the vulnerability allows an attacker to reach administrative endpoints that should be restricted, potentially exposing plugin settings and other sensitive data. While the description does not note arbitrary code execution, the loss of access control threatens the confidentiality and integrity of the WordPress site.

All installations of SiteLock Security – WP Hardening, Login Security & Malware Scans from the earliest available versions up to and including 5.0.2 are vulnerable. The product is offered by SiteLock, and any site running one of these versions is at risk regardless of its WordPress version.

With a CVSS score of 8.8 this vulnerability is high severity. The EPSS score is below 1 %, indicating a relatively low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Attackers would likely target the plugin via web‑based administrative interfaces, crafting requests that exploit the missing access control to gain unauthorized access. The lack of mitigations beyond proper authorization makes the flaw a serious threat when the site is exposed to the network.