A missing authorization check in the NM Gift Registry and Wishlist Lite WordPress plugin allows an attacker to bypass intended security controls. Exploiting this flaw can enable reading or manipulating registry and wishlist data that should be restricted to authorized users only. The weakness is a classic broken access control, matching CWE‑862.

The vulnerability affects the nmerii NM Gift Registry and Wishlist Lite plugin for WordPress, versions from the earliest available up to and including 5.13. Users of any earlier minor releases in the 5.x line are also susceptible.

The CVSS score of 5.3 indicates a moderate severity, and the low EPSS score (<1%) suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation would require access to a WordPress site running the affected plugin, and an attacker could leverage existing authenticated accounts or insufficiently protected endpoints to gain unauthorized access. Because the vulnerability stems from missing access checks rather than an arbitrary input flaw, it does not immediately lead to code execution but can still compromise data confidentiality and integrity.