The vulnerability identified as CVE-2025-62960 affects the Construction Light plugin by sparklewpthemes. It is caused by missing authorization checks, which results in incorrectly configured access control security levels. This allows users with some privileges (PR:L) to perform actions without proper authorization, impacting the integrity and availability of the affected system. The vulnerability is network exploitable (AV:N), requires low attack complexity (AC:L), and does not require user interaction (UI:N). The scope is unchanged (S:U), and the impact is limited to integrity and availability, with no confidentiality impact.

Exploitation of this vulnerability could allow an attacker with limited privileges to perform unauthorized actions that may alter data or disrupt service availability. There is no confidentiality impact reported. The medium severity score reflects moderate risk due to the potential integrity and availability consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fixes or patches are currently documented. Until a patch is available, review and tighten access control configurations in the Construction Light plugin to limit potential exploitation.