The vulnerability identified as CVE-2025-49925 affects the WPLMS plugin by VibeThemes, specifically versions up to and including 1.9.9.7. It is caused by missing authorization checks that allow unauthenticated attackers to access restricted functionality. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without authentication or user interaction, resulting in high confidentiality impact but no integrity or availability impact. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

An attacker can remotely access functionality within the WPLMS plugin that should be restricted, potentially exposing sensitive information or functionality. The impact is limited to confidentiality as per the CVSS vector, with no direct integrity or availability consequences reported. This could lead to unauthorized data disclosure or information leakage within affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected plugin or applying compensating controls such as web application firewalls to limit exposure. Monitor vendor channels for updates regarding patches or official mitigations.