This vulnerability in Progressive WordPress (PWA) arises from missing authorization controls, allowing users with limited privileges to potentially access functionality or data without proper permission checks. The affected versions include all versions up to 2.1.13. The CVSS vector indicates the attack can be performed remotely with low complexity and requires low privileges, but does not require user interaction. The impact is limited to partial confidentiality loss without affecting integrity or availability. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of May 3, 2024.

The vulnerability could allow an attacker with low privileges to access certain data or functionality that should be restricted, resulting in limited confidentiality impact. There is no impact on data integrity or system availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review access controls and limit privileges where possible to reduce exposure. Monitor vendor communications for updates on patches or mitigations.