The vulnerability CVE-2025-39545 affects the miniOrange WordPress REST API Authentication plugin up to version 3.6.3. It arises from missing authorization controls in the REST API authentication mechanism, allowing users with limited privileges to perform actions that should be restricted. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and low availability impacts.

Exploitation of this vulnerability could allow an attacker with low privileges to bypass access control restrictions in the WordPress REST API Authentication plugin, potentially modifying data or disrupting availability. There is no evidence of confidentiality impact or active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges carefully to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.