This vulnerability (CVE-2024-33941) is classified as CWE-862 (Missing Authorization) in the iPanorama 360 WordPress Virtual Tour Builder plugin by Avirtum. It affects all versions up to 1.8.1 and allows unauthorized users to access functionality or data that should require authorization. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability allows unauthorized access to certain features or data within the affected plugin, potentially leading to limited confidentiality loss. There is no impact on integrity or availability reported. Since no exploits are known in the wild, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's administrative interfaces and monitor for updates from Avirtum. No official mitigation or temporary fix is currently documented.