This vulnerability in WP2Speed Faster arises from functionality that is not properly constrained by access control lists (ACLs), leading to exposure of sensitive information to unauthorized users. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, resulting in limited confidentiality impact without affecting integrity or availability. The affected versions include all versions up to 1.0.1. No vendor advisory or patch is currently available, and no exploits have been observed in the wild.

An attacker can remotely access sensitive information that should be protected by access controls. The confidentiality impact is limited, and there is no impact on integrity or availability. This could lead to unauthorized disclosure of data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's functionality through other means such as web application firewalls or limiting user roles. Monitor vendor channels for updates.