This vulnerability in Crelly Slider allows an attacker with some level of privileges to bypass authorization controls by manipulating user-controlled keys. It affects versions up to 1.4.5 and is categorized under CWE-639, which concerns authorization bypass through user-controlled keys. The CVSS score of 4.3 reflects a network attack vector with low complexity and no user interaction required, resulting in limited confidentiality impact but no integrity or availability impact. No vendor advisory or patch information is currently available, and no exploits have been observed in the wild.

An attacker with limited privileges could bypass authorization mechanisms, potentially gaining unauthorized access to certain functionality or data controlled by the plugin. The impact is limited to confidentiality loss without affecting integrity or availability. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for unusual activity related to the plugin. Avoid exposing the plugin to untrusted users where possible.