CVE-2026-109897: Missing Authorization in WP Chill Strong Testimonials

This vulnerability in Strong Testimonials (versions >=0 and <3.3.13) involves missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The issue arises from incorrectly configured access control security levels. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts are present. There is no indication of known exploits in the wild or vendor-provided patches.

An attacker with low privileges can exploit the missing authorization to perform unauthorized actions that may alter data integrity or availability within the Strong Testimonials plugin. Confidentiality is not impacted. The medium severity rating reflects these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and monitor for unusual activity related to the Strong Testimonials plugin.