The vulnerability identified as CVE-2025-48116 affects the EventON plugin by Ashan Perera, specifically versions up to 2.4.4. It is a missing authorization issue where certain functionality is accessible without proper ACL enforcement. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. The vulnerability was published on May 16, 2025, and no patch or vendor advisory is currently available. The product is not a cloud service, so remediation depends on vendor patching or user updates.

The vulnerability allows unauthorized access to certain functionality within EventON, potentially leading to availability disruption. There is no impact on confidentiality or integrity. No known exploits are reported in the wild, indicating limited or no active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected EventON plugin functionality through other means if possible.