The vulnerability identified as CVE-2025-67474 affects the Ultimate Member ForumWP plugin, specifically versions up to 2.1.4. It involves missing authorization checks, which means that the plugin does not properly enforce access control restrictions. This can allow users with limited privileges to execute actions they should not be authorized to perform. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and requires low privileges but no user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability allows an attacker with low privileges to perform unauthorized actions due to missing authorization controls. The impact is limited to integrity, meaning unauthorized modifications or actions could occur, but there is no direct confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Ultimate Member vendor advisories for updates. Until a fix is available, consider restricting access to the affected plugin features to trusted users only and review user permissions carefully.