The vulnerability CVE-2025-47563 in villatheme CURCY WooCommerce multi-currency plugin is caused by missing authorization checks, allowing unauthorized users to access functionality that should be protected by access control lists. This affects all versions up to 2.3.7. The CVSS 3.1 score of 5.3 reflects that the vulnerability can be exploited remotely without privileges or user interaction, but the impact is limited to a low confidentiality loss with no integrity or availability impact. There is no vendor advisory or patch information currently available, and no known exploits have been observed.

An attacker can access functionality that is not properly constrained by authorization controls, potentially leading to unauthorized information disclosure (low confidentiality impact). There is no impact on data integrity or system availability. The vulnerability is remotely exploitable without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's functionality through other means such as web application firewalls or limiting administrative access. Monitor vendor communications for updates on patches or official mitigations.