The vulnerability identified as CVE-2025-31765 affects the themeqx GDPR Cookie Notice plugin up to version 1.2.0. It is due to missing authorization controls, which means that access control security levels are incorrectly configured, allowing unauthorized users to perform actions that should be restricted. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but an integrity impact. No patch or vendor advisory is currently available to confirm remediation status.

The impact is limited to integrity, meaning unauthorized modification or manipulation of certain plugin functions or data may be possible. There is no impact on confidentiality or availability. No known exploits are reported in the wild, so active exploitation is not confirmed at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from themeqx and consider restricting access to the plugin's administrative functions as a precaution.