The vulnerability is a missing authorization flaw that allows attackers to bypass the plugin’s access control rules. By exploiting the incorrect configuration of security levels, an attacker could gain unauthorized access to administrative functions normally reserved for privileged users. This could lead to unauthorized changes to site optimization settings, potentially compromising site performance or security. At its core, the flaw is a classic privilege escalation weakness, identified as CWE-862.

The affected product is the WordPress plugin Asset CleanUp: Page Speed Booster developed by Gabe Livan. All releases from the earliest version through version 1.4.0.3 are vulnerable, as the issue was present up to and including that version.

The CVSS score of 5.3 indicates a moderate severity vulnerability. No EPSS score is currently available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote web interface, where an unauthenticated or minimally authenticated user could request privileged API endpoints. While the exploitation path is straightforward once the vulnerability is discovered, the lack of widespread exploitation reports means the immediate risk remains moderate until a patch is applied.