CVE-2025-57894 describes a missing authorization vulnerability in ollybach WPPizza versions up to 3.19.8. The flaw arises from incorrectly configured access control security levels, which may allow an attacker with low privileges to perform unauthorized integrity-impacting actions. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows an attacker with low privileges to bypass authorization controls, potentially modifying data or performing unauthorized actions that affect the integrity of the system. There is no impact on confidentiality or availability. No known exploits have been reported in the wild, indicating limited or no active exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in WPPizza to ensure proper authorization enforcement. Monitor for vendor updates or security advisories regarding this vulnerability.