This vulnerability in Weblizar's HR Management Lite WordPress plugin (versions <= 3.6) involves missing authorization controls, which means that certain actions or resources may be accessible without proper permission checks. The issue arises from incorrectly configured access control security levels, allowing unauthorized users to perform actions that should be restricted. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Exploitation of this vulnerability could allow an unauthorized attacker to perform limited unauthorized actions affecting the integrity and availability of the affected system. There is no impact on confidentiality. The medium severity score reflects these limited impacts. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.