The vulnerability identified as CVE-2025-66127 affects the Essential Real Estate plugin by g5theme, specifically versions up to 5.3.2. It is characterized by missing authorization checks, which means that certain functions or data can be accessed without proper permission validation. This incorrect access control can lead to unauthorized disclosure of information. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no required privileges or user interaction, impacting confidentiality only. No patch or vendor advisory is provided, and the plugin is not a cloud service.

The impact is limited to confidentiality loss due to unauthorized access enabled by missing authorization controls. There is no impact on integrity or availability. Since no known exploits are reported, the risk is theoretical but should be considered given the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review and tighten access control configurations where possible to limit unauthorized access. Monitor for vendor updates or patches addressing this issue.