The vulnerability identified as CVE-2025-49246 affects the Testimonials Showcase plugin by cmoreira, specifically versions up to 1.9.16. It is a missing authorization issue where access control security levels are incorrectly configured, potentially allowing users with some privileges to perform actions beyond their intended scope. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

The vulnerability allows unauthorized modification or manipulation of data within the Testimonials Showcase plugin due to missing authorization checks. This can lead to integrity issues but does not affect confidentiality or availability. The attack requires some level of privileges but can be executed remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the Testimonials Showcase plugin. Limit user privileges to the minimum necessary and monitor for unusual activity related to testimonial management.