This vulnerability (CWE-602) in Wpmet Wp Ultimate Review arises because security enforcement is performed on the client side rather than the server side, enabling attackers to bypass intended functionality restrictions. The issue affects versions through 2.2.5 of the plugin. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to integrity loss without confidentiality or availability impact. No patch or official remediation level has been disclosed by the vendor or in the advisory.

An attacker can bypass certain functionality restrictions in the Wp Ultimate Review plugin due to improper client-side enforcement of security controls. This may lead to unauthorized actions or integrity violations within the plugin's operation. There is no impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the affected plugin or applying compensating controls if feasible. Monitor vendor communications for updates on patches or official mitigations.