The flaw is a missing authorization error in the Sovlix MeetingHub WordPress plugin. It permits an attacker to use requests that the plugin receives without verifying the caller’s permissions. The result is that anyone who can reach the plugin’s endpoints may gain access to functions that are meant for users with higher privileges, exposing the opportunity for unauthorized use of privileged features.

All WordPress sites that have installed the Sovlix MeetingHub plugin at version 1.25.10 or earlier are affected. The issue applies from the first documented release of the plugin up through and including 1.25.10. No later version is listed in the supplied data, so updating beyond 1.25.10 or removing the plugin is required to eliminate the vulnerability.

The CVSS score of 5.3 indicates a moderate severity risk, while the EPSS score of less than 1 % shows a low probability that the flaw will be actively exploited at present. The vulnerability is not included in the CISA KEV catalogue. An attacker can exploit the weakness by crafting HTTP requests to the plugin’s endpoints, without needing elevated credentials beyond a standard site user. The impact is limited to unauthorized access to the plugin’s privileged features, and the extent of potential damage depends on the specific configuration and data handled by the plugin.