The Website Builder by SeedProd plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the 'seedprod_lite_get_revisisons' function. This flaw allows any authenticated user with at least Subscriber privileges to access the content of arbitrary landing page revisions without proper capability checks. The vulnerability affects all versions up to and including 6.18.15. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and network attack vector but limited impact to confidentiality only. No official patch or remediation details are currently available.

Authenticated users with Subscriber-level access or higher can read the content of arbitrary landing page revisions, potentially exposing sensitive or confidential information stored in those revisions. There is no impact on data integrity or availability. The vulnerability does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for any suspicious activity related to landing page revisions. Avoid granting unnecessary authenticated access to the plugin features.