This vulnerability (CWE-862) in the Leopard - WordPress offload media plugin allows users with limited privileges to access functionality without proper authorization checks. The issue affects all versions up to 2.0.36. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No patch or official fix has been published by the vendor as of the latest information.

An attacker with some level of privileges can perform actions that should be restricted, potentially leading to integrity loss and high availability impact of the affected WordPress plugin. There is no confidentiality impact reported. The vulnerability could disrupt service or functionality of the plugin, but no known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who can interact with the plugin.