The PickPlugins Testimonial Slider plugin up to version 2.0.15 suffers from a missing authorization vulnerability, allowing users with low privileges to perform unauthorized actions due to incorrect access control configuration. This vulnerability affects the integrity of testimonial data but does not compromise confidentiality or availability. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and high integrity impact. No patch or vendor advisory information is currently available.

Exploitation of this vulnerability can lead to unauthorized modification of testimonial content within the affected plugin, impacting data integrity. There is no impact on confidentiality or availability. The medium severity score reflects the potential for integrity compromise by an attacker with low privileges over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions to trusted users only and monitor for unauthorized changes. Avoid exposing the plugin to untrusted users where possible.