Missing authorization in the Site Suggest WordPress plugin permits unauthenticated or insufficiently privileged users to invoke protected actions, potentially exposing site data or enabling configuration changes. The flaw is a classic broken access control (CWE‑862) and could allow attackers to elevate privileges or manipulate content.

The plugin is distributed by Aryan Shirani Bid Abadi as Site Suggest. All releases up to and including 1.3.9 contain the vulnerability; any WordPress site using the plugin at a version <= 1.3.9 is susceptible.

The CVSS v3.1 score of 6.5 indicates moderate severity, while the EPSS figure of less than 1% points to a low probability of exploitation. The vulnerability has not been recorded in CISA’s KEV catalog, suggesting no publicly known exploits. Attackers would likely target the plugin’s admin endpoints via the web interface, exploiting the absence of role checks. Mitigation hinges on removing the vulnerable code by upgrading the plugin and ensuring that only administrator‑level users can access its administrative interfaces.