This vulnerability in the raratheme Preschool and Kindergarten plugin (versions up to 1.2.5) is due to missing authorization checks, which results in incorrect access control configurations. The CVSS score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability. The issue allows unauthorized modification or manipulation of data or functionality due to insufficient access restrictions.

The vulnerability allows an attacker to exploit missing authorization controls, potentially leading to unauthorized integrity modifications within the affected plugin. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected plugin or implementing compensating controls to limit unauthorized access.