Technical impact
The vulnerability is a missing authorization check in the Responsive Blocks plugin. It allows any user who can trigger the affected functions to access configuration settings that should be restricted, potentially leading to unauthorized changes to the plugin’s configuration. This weakness is classified as CWE-862 (Missing Authorization).
Affected Systems
CyberChimps Responsive Blocks plugin for WordPress, all releases up to and including version 2.2.0, as identified by the vendor advisory.
Risk and Exploitability
CVSS score 5.3 indicates moderate severity, while the EPSS score of < 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attack likely requires authenticated access to WordPress with permission to load plugin settings; the description does not specify authentication explicitly, so this inference is drawn from typical plugin behavior.
