This vulnerability in the Blend Media WordPress CTA plugin arises from missing authorization checks, allowing unauthorized access due to improperly configured access control. It affects all versions up to and including 2.1.2. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and limited confidentiality and availability impacts. No official patch or remediation guidance is currently documented.

An attacker can exploit this vulnerability remotely without authentication or user interaction to gain limited unauthorized access, potentially leading to partial confidentiality loss and limited availability impact. The exact consequences depend on the plugin's role and data handled but are limited to the scope defined by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's administrative interfaces and monitor for unusual activity related to the plugin. Avoid exposing the affected plugin to untrusted networks where possible.