This vulnerability in GS Portfolio for Envato arises from missing authorization checks, leading to incorrect access control configurations. It affects versions up to and including 1.4.2. The issue allows unauthorized users to perform actions that should require proper authorization, impacting the integrity of the system. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability allows unauthorized modification or actions within the affected plugin due to missing authorization controls, impacting data integrity. There is no impact on confidentiality or availability. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected plugin and reviewing access control configurations to minimize exposure.