This vulnerability in the Core Web Vitals & PageSpeed Booster plugin arises from missing authorization checks, which could allow an attacker with low privileges to access or modify resources without proper permissions. The issue affects all versions up to and including 1.0.28. The CVSS vector indicates the attack can be performed remotely over the network, requires low privileges, and does not require user interaction. The impact is limited to low confidentiality and integrity loss, with no availability impact. There is no vendor advisory or patch information available at this time.

Exploitation of this vulnerability could lead to unauthorized access or modification of data within the affected plugin's scope, resulting in limited confidentiality and integrity compromise. There is no indication of availability impact or widespread exploitation. The vulnerability requires an attacker to have low privileges, limiting the attack surface to authenticated users with some access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations related to the plugin where possible. Monitor for updates from the vendor or security advisories to apply patches promptly once available.