This vulnerability in the A WP Life Login Page Customizer plugin arises from missing authorization checks in the customizer-login-page, admin page, and custom design components. It affects versions up to and including 2.1.1. The issue allows attackers without privileges to perform actions that should be restricted, resulting in integrity and availability impacts. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.

Exploitation of this vulnerability can lead to unauthorized modification of plugin settings or disruption of plugin functionality, impacting the integrity and availability of the affected system. Confidentiality is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative interfaces and monitor for unusual activity related to the plugin. Avoid using affected versions in production environments if possible.