The reported defect is a Broken Access Control flaw in the WordPress Slim SEO plugin versions up to and including 4.6.2. This vulnerability allows an attacker who has no privileged permissions on the site to perform functions that should be restricted to privileged users. Based on the nature of the weakness, it is inferred that an attacker could potentially alter plugin configuration or access sensitive data linked to the plugin, thereby moving the threat from a purely functional issue to one that could affect site integrity.

The problem exists in installations of the eLightUp Slim SEO WordPress plugin running version 4.6.2 or earlier. Sites that have upgraded to 4.7.0 or newer are not affected by this specific issue.

The CVSS base score of 6.5 signals a moderate severity level. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no current evidence of widespread exploitation. The likely attack vector is through the web interface of a WordPress site; any user can reach the plugin’s endpoints because the plugin fails to enforce proper access control. Consequently, the risk remains significant while exploitation evidence is limited, warranting remediation.