The VillaTheme Thank You Page Customizer for WooCommerce plugin suffers from a missing authorization vulnerability (CVE-2025-30993) in versions up to 1.1.7. This issue arises due to incorrectly configured access control, allowing attackers with low privileges to perform unauthorized actions or access data. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official fix information is currently available.

An attacker with low privileges could exploit this vulnerability to gain unauthorized access to certain functionalities or data within the Thank You Page Customizer plugin, potentially leading to confidentiality breaches. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin features to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who can interact with the Thank You Page Customizer.