This vulnerability is a missing authorization flaw in the Arjan Pronk linkPizza‑Manager WordPress plugin that allows an attacker to exploit incorrectly configured access control security levels. Because the plugin does not validate user permissions properly, an attacker can invoke administrative or protected functionality intended only for authorized users. The consequence is that data or settings managed by the plugin could be read, altered, or deleted, compromising the integrity and confidentiality of the site content.

The issue impacts the linkPizza‑Manager plugin distributed by Arjan Pronk for WordPress platforms. All installations of the plugin with versions up to and including 5.5.5 are affected. No other WordPress plugins or core software are listed as affected.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% reflects a low probability of exploitation in the wild, and the vulnerability is not present in the CISA KEV list. Based on the description, it is inferred that the attack vector is through the web interface of the affected plugin, where a user—authenticated or potentially unauthenticated—could trigger privileged operations without proper checks. The exploit would require basic knowledge of the plugin’s administrative URLs or form submissions, making it relatively easy to conduct in a susceptible environment.