The vulnerability identified as CVE-2025-46485 affects the WP Customize Login Page plugin for WordPress, developed by Carlo La Pera. It is caused by missing authorization checks, allowing unauthenticated remote attackers to access certain plugin functionalities that should be protected by ACLs. The CVSS score is 5.3 (medium severity) with the vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact, and no availability impact. The affected versions include all versions up to 1.6.5. No patch or official remediation information is currently available.

This vulnerability allows unauthorized remote attackers to perform actions that require authorization within the WP Customize Login Page plugin, potentially leading to integrity issues such as unauthorized modification of plugin settings or behavior. There is no impact on confidentiality or availability reported. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative interfaces and monitor for unusual activity related to the plugin. Avoid exposing the WordPress admin area to untrusted networks.