This vulnerability in e-plugins Lawyer Directory (<= 1.3.3) is due to missing authorization checks, resulting from incorrectly configured access control security levels. This allows an attacker with low privileges to perform unauthorized actions that can impact the integrity and availability of the system. The CVSS 3.1 score of 7.6 reflects network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact. No vendor patch or advisory details are currently available to confirm remediation status.

An attacker with low privileges could exploit the missing authorization to perform unauthorized actions that may alter data integrity and cause limited availability disruption. Confidentiality impact is low. The vulnerability could lead to unauthorized modifications within the Lawyer Directory plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Lawyer Directory plugin to trusted users only and monitor for unusual activity related to access control. Avoid exposing the affected versions publicly where possible.