This vulnerability in the PPWP plugin by WP Folio Team is due to missing authorization checks, allowing exploitation of incorrectly configured access control security levels. It affects all versions up to and including 1.9.15. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction. The impact is limited to partial confidentiality and integrity loss without affecting availability. No patch or mitigation details are currently available from the vendor or other sources.

An attacker with low privileges can exploit the missing authorization to access or modify data that should be restricted, leading to partial confidentiality and integrity compromise. There is no impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for unusual activity related to access control. Avoid granting unnecessary privileges to users.