This vulnerability in the vanquish User Extra Fields WordPress plugin arises from missing authorization checks, which can be exploited due to incorrectly configured access control security levels. It affects versions up to 16.8 and allows an attacker to access certain user extra fields without proper permissions. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to partial confidentiality loss without affecting integrity or availability. No patch or vendor advisory has been provided to confirm remediation status.

The vulnerability allows unauthorized access to user extra fields, potentially exposing some confidential information. There is no impact on data integrity or system availability. No known active exploitation has been reported, reducing immediate risk, but the exposure of user data could lead to privacy concerns.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality where possible and monitor for updates from the vendor. Avoid exposing sensitive user extra fields publicly or to untrusted users.