The vulnerability identified as CVE-2025-63077 concerns a missing authorization control in the HappyMonster Happy Addons for Elementor plugin (versions up to 3.20.3). This flaw allows users with limited privileges to bypass intended access restrictions, potentially performing unauthorized operations within the plugin. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but with some integrity impact. No vendor advisory or patch information is currently provided, and no exploits are known in the wild.

The impact is limited to integrity as per the CVSS vector, meaning an attacker with low privileges could perform unauthorized actions that may modify data or plugin behavior. There is no reported impact on confidentiality or availability. Since no known exploits are reported, the practical risk may be limited but should not be ignored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who can interact with the plugin.