This vulnerability in Croover.inc's Rich Table of Contents plugin (up to version 1.4.0) is caused by missing authorization checks, which results in incorrectly configured access control security levels. The issue allows an attacker with low privileges to perform unauthorized actions that impact the integrity of the system. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows an attacker with low privileges to bypass access control restrictions, potentially modifying data or configurations without proper authorization. There is no impact on confidentiality or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to access control. Avoid granting unnecessary privileges to users interacting with the Rich Table of Contents plugin.