This vulnerability (CVE-2025-14361) in AA-Team Woocommerce Envato Affiliates is classified as CWE-862 (Missing Authorization). It affects versions up to 1.2.1 and allows users with some privileges (PR:L) to access functionality without proper authorization controls, leading to a high impact on integrity and a low impact on availability. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no user interaction required, and unchanged scope. No patch or official fix has been published by the vendor, and it is not a cloud service.

The vulnerability allows unauthorized access to certain functions within the Woocommerce Envato Affiliates plugin, potentially enabling privilege escalation or unauthorized modification of data (integrity impact is high). Availability impact is low. Confidentiality is not affected. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit user privileges where possible to reduce risk. Monitor vendor communications for updates on patches or mitigations.