This vulnerability involves missing authorization checks in the sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WordPress plugin (versions up to 4.48). It allows users with limited privileges to perform actions that should require higher authorization, due to incorrect access control configurations. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges but no user interaction, and impacting integrity only.

The vulnerability allows an attacker with some level of privileges to bypass intended access controls, potentially modifying plugin data or settings without proper authorization. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and monitor for suspicious activity related to plugin configuration changes.