The vulnerability is a missing authorization check in the Suggestion Toolkit WordPress plugin, allowing users without proper privileges to perform actions or view data that the plugin protects. This flaw can result in unauthorized data exposure or manipulation of plugin settings, threatening the integrity of the site’s content and configuration. The weakness is classified as CWE‑862: Broken Access Control.

WordPress sites that have installed the Suggestion Toolkit plugin from Sergiy Dzysyak, version 5.0 or earlier, are affected. Any installation that has not upgraded past the 5.0 release and relies on this plugin for any functionality is susceptible. Site administrators should verify the plugin version and review the vendor’s release notes for updates.

The CVSS score of 5.4 places this vulnerability in the medium severity range, and the EPSS score indicates a low likelihood of exploitation. It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector is not explicitly detailed in the advisory; however, it is inferred that an attacker would need to send HTTP requests to plugin endpoints that lack proper access controls, and may require either valid credentials or the ability to create user accounts with insufficient restrictions. Proper configuration and up‑to‑date versions significantly reduce the risk.