The Search & Filter Pro plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the 'get_meta_values' function in all versions up to 2.5.19. This flaw permits authenticated users with minimal privileges (Subscriber-level and above) to access arbitrary post meta data without proper capability checks. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact primarily on confidentiality. No patch or vendor advisory is currently referenced, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with authenticated access at Subscriber level or higher can read arbitrary post meta values, potentially exposing sensitive or private information stored in WordPress post metadata. There is no impact on data integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for plugin updates from the vendor. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if sensitive data exposure risk is unacceptable.