This vulnerability (CVE-2025-63078) in the Restaurant Menu by MotoPress plugin (versions <= 2.4.11) is classified as a missing authorization issue (CWE-862). It permits users with subscriber-level privileges to perform actions or access resources without proper authorization. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and impacts integrity only. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

The vulnerability allows unauthorized modification or actions by subscriber-level users, impacting the integrity of the affected system. There is no impact on confidentiality or availability according to the CVSS vector. Exploitation could lead to unauthorized changes within the plugin's functionality but does not disclose sensitive information or cause denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual activity related to the Restaurant Menu by MotoPress plugin. Avoid granting unnecessary permissions to subscriber roles.