The vulnerability identified as CVE-2025-49288 affects the Rustaurius Ultimate WP Mail plugin for WordPress, specifically versions up to 1.3.5. It is characterized as a Missing Authorization issue that permits authentication bypass, allowing users with some level of privileges to circumvent authorization controls. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to bypass authorization mechanisms, potentially leading to unauthorized access or actions within the Ultimate WP Mail plugin. This could compromise the confidentiality, integrity, and availability of the affected system. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Rustaurius and consider restricting access to the plugin or limiting user privileges as a precautionary measure.