This vulnerability is a missing authorization flaw in the WP Chill Revive.so WordPress plugin that allows attackers to exploit incorrectly configured access control. The flaw enables unauthorized users to perform privileged actions, such as accessing or modifying plugin settings, potentially allowing further compromise of the site. The underlying weakness is a broken access control defined by CWE-862.

The issue affects WP Chill’s Revive.so plugin for WordPress with versions from the earliest available release through version 2.0.7 inclusive. WordPress sites that rely on this plugin and have not upgraded beyond 2.0.7 are impacted.

The CVSS score of 5.3 indicates medium severity, while the EPSS score below 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers likely can leverage the flaw by sending crafted requests to the plugin’s endpoints from any web‑accessible location, bypassing normal permission checks. Because it requires only authenticated or anonymous access to the site, the exploitation risk is moderate, but mitigated by the low EPSS and lack of known exploits.