The vulnerability CVE-2025-28995 in Viral Loops WP Integration is due to missing authorization controls, which means that certain functions or resources within the plugin can be accessed or manipulated without proper permission checks. This affects versions up to 3.8.1 and could allow unauthorized users to impact the integrity of the system, though it does not affect confidentiality or availability. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity. No patch or official fix information is currently available.

The impact is limited to integrity as unauthorized users may be able to perform actions they should not be permitted to, potentially altering data or configurations within the plugin. There is no reported impact on confidentiality or availability. No known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality to trusted users only and monitor for unusual activity related to the plugin. Avoid exposing the plugin's administrative functions to untrusted networks or users.