This vulnerability in WPGuppy wpguppy-lite arises from missing authorization checks, enabling unauthorized users to access functionality that should be restricted by ACLs. It affects all versions up to 1.1.4. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows unauthorized remote attackers to access sensitive functionality, potentially leading to disclosure of confidential information. The integrity impact is low, and availability is not affected. No known exploitation in the wild has been reported, but the high CVSS score reflects a serious confidentiality risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin or disable it if possible to prevent unauthorized access. Monitor official channels from AmentoTech Private Limited for updates on patches or mitigations.