The vulnerability permits unauthenticated users to reference objects they should not access, potentially allowing the reading or alteration of data protected by the Blocksy Companion Pro plugin. The inherent weakness is a classic Insecure Direct Object Reference, categorized as CWE‑639, which can lead to information disclosure or integrity compromise if sensitive data becomes accessible.

Creative Themes Blocksy Companion Pro versions up to and including 2.1.46 are affected. No other vendors or products are listed as impacted.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV. Based on the description, the attack likely requires crafting a URL or request to a protected endpoint, with no specified authentication needed. While the exploitation path is straightforward, the overall risk to systems depends on the sensitivity of the data exposed by the plugin.