This vulnerability in ThemeGoods Photography plugin (<= 7.7.2) is due to missing authorization controls, which means certain actions or resources may be accessible without proper permission checks. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, requiring low privileges but no user interaction, and resulting in low impact on confidentiality, integrity, and availability. The lack of authorization could allow an attacker with limited privileges to perform unauthorized actions within the plugin.

The vulnerability allows an attacker with low privileges to bypass access control restrictions, potentially leading to unauthorized access or modification of data and limited disruption of service. The impact is rated as medium severity with low confidentiality, integrity, and availability impacts according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeGoods advisories for updates. Until a fix is available, review and tighten access control configurations where possible to limit exposure.