This vulnerability is a missing authorization flaw in the NM Gift Registry and Wishlist Lite WordPress plugin. Because the plugin does not enforce proper access control, any visitor can reach protected functionality without authentication. The weakness allows an attacker to read or modify registry and wishlist records that may contain personal or sensitive user information. The flaw is classified as a breach of access control (CWE‑862).

The affected product is the NM Gift Registry and Wishlist Lite plugin developed by nmerii. Versions up to and including 5.13 are vulnerable. No additional vendor or version details are disclosed beyond this upper bound. Any WordPress site running the plugin in this range is impacted.

The publicly available severity and exploit probability metrics are not disclosed, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the plugin’s web interfaces, enabling an unauthenticated user to access administrative pages or data. The risk is moderate to high if the plugin stores personal data, as an attacker could read, modify, or delete registry entries without permission.