This vulnerability in Olive Themes Olive One Click Demo Import plugin arises from functionality that is not properly constrained by access control lists (ACLs), allowing unauthorized users to access sensitive information. The affected versions include all versions up to 1.1.2. The CVSS 3.1 base score is 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss only. No official patch or vendor advisory is currently available to confirm remediation status.

An attacker can remotely access sensitive information without authentication due to insufficient access control enforcement. The impact is limited to confidentiality loss; integrity and availability are not affected. No known exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality where possible and monitor for updates from Olive Themes. Avoid exposing the plugin to untrusted networks or users.