The vulnerability is a Missing Authorization flaw (CWE-862) in the WordPress plugin Permalink Manager Lite that allows attackers to manipulate permalink settings without proper authentication or authorization checks. This can undermine data integrity and disrupt site navigation, potentially causing availability issues if key URLs are altered or removed.

WordPress sites using Permalink Manager Lite versions released prior to 2.5.3 are affected. All releases earlier than 2.5.3 contain the flaw, regardless of minor version changes.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% reflects a low probability of exploitation in the current environment. The vulnerability has no entry in the CISA KEV catalog. The likely attack vector is inferred to be exploitation of internal plugin endpoints accessible through the site's backend; this inference is based on the description of missing authorization checks. If an attacker gains access, they can modify or delete permalink configurations, affecting the site structure and user experience.