The vulnerability CVE-2025-28996 affects the GPP Slideshow plugin (version <= 1.3.5) by Thad Allender. It is caused by missing authorization controls, which means that certain operations can be performed without proper permission checks. This is due to incorrectly configured access control security levels within the plugin. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and impacting only integrity without affecting confidentiality or availability.

Exploitation of this vulnerability could allow an attacker with low privileges to perform unauthorized actions that modify data or application state, impacting integrity. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until then, restrict access to the plugin's management interfaces to trusted users only to reduce risk.