The vulnerability identified as CVE-2025-67578 affects the WP Email Capture plugin by Rhys Wynne. It is caused by missing authorization checks, allowing unauthorized access due to incorrectly configured access control security levels. This can lead to integrity impacts, such as unauthorized modification of data or settings within the plugin. The issue affects all versions up to and including 3.12.4. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to integrity without confidentiality or availability impact.

The impact of this vulnerability is limited to integrity, meaning unauthorized users could potentially alter data or configurations within the WP Email Capture plugin. There is no impact on confidentiality or availability. Since no known exploits are in the wild, the risk of active exploitation is currently low. However, the vulnerability could be leveraged by attackers to manipulate plugin data if left unaddressed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor Rhys Wynne's official channels for updates. Until a fix is available, restricting access to the plugin's administrative functions and limiting exposure to untrusted users may reduce risk.