The vulnerability is a missing authorization condition in PickPlugins Product Slider for WooCommerce, allowing exploitation of incorrectly configured access control security levels. Attackers can reach administrative actions or functionality within the plugin without proper authentication, potentially modifying slider content on WordPress sites and compromising site presentation. This unauthorized access aligns with the authentication‑authorization weakness identified by CWE‑862.

This issue affects the PickPlugins Product Slider for WooCommerce for all WordPress sites that have the plugin version n/a through <= 1.13.61. Any site running the plugin within that version range is vulnerable; the plugin must be updated to address the missing access control.

The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via unauthenticated HTTP requests to administrative endpoints of the plugin, based on the missing authorization requirement, though this inference is drawn from the description and not explicitly stated in the CVE text.