The vulnerability identified as CVE-2025-64259 involves missing authorization checks in the Theater for WordPress plugin (versions up to 0.18.8). This results from incorrectly configured access control security levels, which could allow unauthorized users to perform actions they should not be permitted to. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low complexity, and impacts integrity but not confidentiality or availability.

The impact is limited to integrity, meaning unauthorized modification or manipulation of data or functionality within the plugin is possible. There is no direct impact on confidentiality or availability. The medium severity reflects a moderate risk where unauthorized changes could affect the plugin's operation or data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's administrative functions and reviewing access control configurations to minimize exposure.