The vulnerability involves a missing authorization condition in the PickPlugins Product Slider for WooCommerce plugin, allowing access to administrative functions without proper authentication. This flaw enables an attacker to modify or control slider elements, potentially altering the way products are displayed on a WordPress site and compromising content integrity. The weakness corresponds to the common missing‑authorization defect identified by CWE‑862.

This issue affects the PickPlugins Product Slider for WooCommerce for all WordPress sites that have the plugin version n/a through 1.13.60. Any site running the plugin within that version range is vulnerable; the plugin must be updated to address the missing access control.

The CVSS score of 6.5 indicates medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via unauthenticated HTTP requests to administrative endpoints of the plugin, based on the missing authorization requirement, though this inference is drawn from the description and not explicitly stated in the CVE text.