This vulnerability in the Email Notifications for Updates plugin by AWEOS GmbH arises from missing authorization controls, enabling users with limited privileges to escalate their privileges. It affects versions up to and including 1.1.6. The CVSS 3.1 base score is 8.8, indicating a high impact with network attack vector, low attack complexity, privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or official remediation details are currently provided.

Successful exploitation allows privilege escalation, potentially granting an attacker higher-level access than intended. This can lead to full compromise of the system's confidentiality, integrity, and availability. No known active exploits have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for unusual privilege escalations. Avoid granting unnecessary privileges to users who can interact with this plugin.