This vulnerability in onOffice for WP-Websites is caused by missing authorization checks stemming from misconfigured access control security levels. It allows an attacker with some privileges (low privileges required) to perform unauthorized actions that can alter data integrity and availability. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts. Affected versions include all versions up to 6.5.1. No patch or vendor advisory is currently available.

Exploitation of this vulnerability could allow an attacker with low privileges to perform unauthorized actions that impact the integrity and availability of the affected system. Confidentiality is not impacted. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to onOffice for WP-Websites. Avoid granting unnecessary privileges that could be leveraged to exploit this missing authorization issue.