This vulnerability (CWE-862) in the Themeisle Multiple Page Generator Plugin – MPG arises from missing authorization controls, allowing users with some privileges to potentially perform unauthorized actions. It affects all versions up to 3.4.0. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring privileges, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently provided, and no exploits have been reported.

The vulnerability could allow an attacker with some level of privilege to bypass authorization checks, potentially leading to limited unauthorized information disclosure. There is no impact on data integrity or availability. The overall impact is considered medium severity based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who can interact with the plugin.