The vulnerability CVE-2025-48096 affects the FRESHFACE Custom CSS plugin through version 1.4.0. It is caused by missing authorization checks in the custom-css-editor component, which leads to incorrect access control enforcement. This can allow an unauthenticated attacker to perform actions that should require authorization, impacting the integrity and availability of the affected system. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with no confidentiality impact but with integrity and availability impacts rated as low and high respectively.

Exploitation of this vulnerability could allow an attacker to modify or disrupt the Custom CSS functionality without proper authorization, potentially affecting the integrity and availability of the affected system. There is no confidentiality impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the Custom CSS editor component to trusted users only to reduce risk.