The wpWax Legal Pages plugin suffers from a missing authorization vulnerability affecting versions up to 1.4.6. This issue arises from incorrectly configured access control security levels, which may allow unauthorized users to perform actions that should require authorization. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No known exploits in the wild or patches have been reported yet.

Exploitation of this vulnerability could allow an attacker to perform unauthorized modifications within the Legal Pages plugin context, potentially altering legal page content or settings. There is no reported impact on confidentiality or availability. The medium severity reflects the integrity impact without elevated privileges or user interaction requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from wpWax and consider restricting access to the plugin's administrative interfaces as a precaution.