This vulnerability in PickPlugins Testimonial Slider arises from missing authorization checks, allowing users with limited privileges to access functionality or data that should be restricted. It affects all versions up to 2.0.15. The CVSS 3.1 base score is 6.5 (medium severity), with an attack vector of network, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality only. No vendor advisory or patch information is provided, and the product is not a cloud service.

An attacker with limited privileges can exploit the missing authorization to gain unauthorized access to sensitive information within the Testimonial Slider plugin. The impact is limited to confidentiality breaches; integrity and availability are not affected. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted users only and monitor for unusual activity related to testimonial management. Avoid granting unnecessary privileges to users who can interact with the Testimonial Slider plugin.