This vulnerability (CVE-2025-24653) in NotFound Admin and Site Enhancements (ASE) Pro is classified as CWE-862 (Missing Authorization). It arises from improper access control configurations that fail to enforce correct authorization checks, allowing users with limited privileges to perform actions they should not be authorized to execute. The affected product versions include all versions up to 7.6.1.1. The CVSS v3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The impact is limited to integrity as unauthorized users with limited privileges may perform unauthorized actions due to missing authorization checks. There is no impact on confidentiality or availability. The vulnerability does not require user interaction and can be exploited remotely over the network. No known exploits have been reported in the wild.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should review and tighten access control configurations in the affected product to mitigate potential unauthorized actions.