The vulnerability identified as CVE-2025-29001 in the ZoomIt WooCommerce Shop Page Builder plugin is classified as CWE-862 (Missing Authorization). It allows exploitation of improperly configured access control mechanisms, enabling users with some privileges to perform actions they should not be authorized to execute. The issue affects versions up to 2.27.7 of the plugin. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official fix has been published, and the product is not a cloud service, so remediation depends on vendor updates.

The impact is limited to a low integrity compromise, meaning an attacker with some privileges could perform unauthorized actions within the WooCommerce Shop Page Builder plugin. There is no confidentiality or availability impact reported. The vulnerability does not appear to be actively exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the plugin's administrative functions to trusted users only to minimize risk.