Note by Patchstack

Attention! This security issue was rejected on 2024 Jan 25, this entry will be deleted soon. This issue (reported in version 5.0.5) is related to a Broken Access Control where the Contributor role user can preview any created tables using the shortcode, which should only be accessible to the Administrator role or role assigned to access the plugin feature. The vendor has released the working patch, but the problem is partly on the core side.

A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

Update to version 5.0.7 or later to resolve the vulnerability. Patchstack users can turn on auto-update for vulnerable plugins only.