The vulnerability identified as CVE-2025-53291 involves missing authorization controls in the spoddev2021 Spreadconnect plugin (wc-spod component) for versions up to 2.1.5. This allows an attacker with low privileges to execute actions without proper authorization, potentially causing limited integrity and availability issues. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker with low privileges can exploit this missing authorization vulnerability to perform unauthorized actions within the affected Spreadconnect plugin, potentially leading to limited integrity and availability disruptions. There is no confidentiality impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected plugin features to trusted users only and consider disabling the plugin if feasible.