The vulnerability CVE-2025-28874 in shanebp BP Email Assign Templates (<= 1.7) allows an authorization bypass through a user-controlled key due to improperly configured access control security levels. This enables an attacker with high privileges to bypass intended authorization checks, potentially leading to high impact on integrity and availability. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high impact on integrity and availability.

An attacker with high privileges can exploit this vulnerability to bypass authorization controls, potentially modifying or disrupting email assignment templates managed by the plugin. This could lead to unauthorized changes affecting the integrity and availability of the affected system components. There is no indication of confidentiality impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, restrict high privilege access to trusted users only and review access control configurations to minimize exposure.