The vulnerability identified as CVE-2025-49431 affects the MF Plus WPML plugin by Gnuget. It is caused by missing authorization checks, which means that the plugin does not properly enforce access control security levels. This can allow unauthorized users to perform actions that should be restricted. The issue affects all versions up to 1.1. The CVSS v3.1 base score is 6.5, with the vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions due to missing authorization controls. The impact is limited to integrity and availability with low severity, and there is no confidentiality impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected plugin where possible and review access control configurations to minimize exposure.