The vulnerability CVE-2025-31768 affects OTWthemes Widget Manager Light up to version 1.18. It is caused by missing authorization checks, allowing unauthorized access to certain functionality that should be restricted by ACLs. The CVSS 3.1 base score is 6.5, with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform actions or access features that should be restricted, potentially leading to limited integrity and availability impacts. There is no confidentiality impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor OTWthemes communications for updates and apply any official patches once available. In the meantime, restrict access to the affected widget manager where possible.