The vulnerability in Sovlix MeetingHub (v ≤ 1.25.10) is a missing Authorization flaw (CWE‑862) that allows an attacker to invoke the plugin’s end‑points without verifying the caller’s permissions. The result is that anyone who can reach the plugin’s URLs can access functions that are intended for higher‑privilege users, potentially exposing sensitive data, enabling scheduling or session configuration changes, or other privileged operations. The vulnerability is not an arbitrary code execution but a privilege escalation within the plugin’s scope. Based on the description, the likely attack vector is crafting HTTP requests to the plugin’s endpoints; this inference is made because the CWE and the plugin nature indicate that protocol‑level requests are the entry point.

All WordPress sites that have installed the Sovlix MeetingHub plugin at version 1.25.10 or earlier are affected. This includes any site from the first documented release of the plugin up through and including 1.25.10. No later version is referenced in the provided data, so updating to a newer version or removing the plugin is required to eliminate the vulnerability.

The CVSS score of 5.3 indicates a moderate severity risk, while the EPSS score of less than 1 % shows a low probability that the flaw will be actively exploited at present. The vulnerability is not listed in the CISA KEV catalogue. An attacker can exploit the weakness by sending crafted HTTP requests to the plugin’s end‑points, without needing elevated credentials beyond a standard site user. The impact is limited to unauthorized access to the plugin’s privileged features, and the extent of potential damage depends on the specific configuration and data handled by the plugin.