CVE-2025-57909 describes a missing authorization vulnerability in the Rouergue Création Editor Custom Color Palette plugin (versions up to 3.5.6). This vulnerability arises from incorrectly configured access control security levels, allowing users with limited privileges to access or manipulate functionality without proper authorization. The CVSS 3.1 score of 6.5 reflects a medium severity, with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or official vendor advisory is currently available, and no known exploits have been reported.

The vulnerability allows users with some privileges to bypass access control restrictions, potentially exposing sensitive data within the Editor Custom Color Palette plugin. Confidentiality impact is high, but integrity and availability are not affected. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin to trusted users only and monitor for unusual activity related to the Editor Custom Color Palette functionality.