The vulnerability is a missing authorization flaw that allows attackers to exploit incorrect access control settings in the Wp Ultimate Review plugin. Because the plugin fails to enforce proper permissions, a malicious user can potentially read, modify, or delete reviews and other managed content. This flaw directly undermines the confidentiality and integrity of site data within WordPress sites that use affected plugin versions.

The affected product is the Roxnor Wp Ultimate Review WordPress plugin. All releases from the earliest available version up to and including 2.3.8 are impacted. No specific patch levels are listed beyond the version ceiling of 2.3.8.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the plugin is accessed via the WordPress web interface, the attack vector is inferred to be remote and network based, potentially allowing attackers to target the site over the internet. Exploitation requires the ability to access the plugin’s administrative functionality, which may be limited by existing permissions on the site.