This vulnerability (CWE-862) in the WP Meta and Date Remover plugin arises from missing authorization checks, which could allow an attacker with low privileges to exploit improperly configured access controls. The issue affects all versions up to 2.3.6. The CVSS 3.1 vector indicates that the attack can be performed remotely over the network with low complexity and requires low privileges, but does not require user interaction. The impact is limited to a low confidentiality loss, with no integrity or availability impact. No vendor advisory or patch information is currently available.

An attacker with low privileges could exploit the missing authorization to access or manipulate functionality that should be restricted, potentially leading to limited confidentiality exposure. There is no indication of impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality to trusted users only and monitor for unusual activity related to this plugin. Avoid granting unnecessary privileges to users who can interact with the plugin.