This vulnerability (CVE-2025-31046) in WPvibes AnyWhere Elementor Pro is classified as CWE-862 (Missing Authorization). It arises from improperly configured access control mechanisms, allowing an attacker with some privileges to perform actions beyond their authorization scope. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, no user interaction, and resulting in limited integrity impact without confidentiality or availability loss. The affected product versions include all versions up to 2.29. There is no vendor advisory or patch information available at this time.

The impact is limited to integrity, meaning an attacker could potentially modify data or perform unauthorized actions within the application. Confidentiality and availability are not impacted according to the CVSS vector. The vulnerability requires the attacker to have some level of privileges (PR:L) and can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor WPvibes communications for updates. Until a patch is available, restrict access to the affected plugin and review user privileges to minimize risk.