The vulnerability is a missing authorization flaw in the unFocus Projects Scripts n Styles WordPress plugin. Because the plugin allows management pages to be accessed without verifying the user’s role, an attacker could gain elevated privileges and modify, delete, or tamper with plugin settings and resources. This bug is classified as CWE‑862 and can affect a site’s configuration, potentially enabling a range of post‑login exploits if the attacker is able to authenticate with low privileges.

WordPress sites that have the Scripts n Styles plugin installed with a version up to 3.5.8, including all intermediate releases. The issue applies to all installations of the plugin released before the 3.5.9 update.

With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation at this time. The likely attack vector is a web‑based request to the plugin’s administrative URLs, which can be triggered by any authenticated user who gains access to the site. If the site is exposed to an attacker who can authenticate, the missing access controls could be leveraged to alter plugin configuration, inject scripts, or otherwise impact the site’s confidentiality, integrity, or availability.