The vulnerability CVE-2025-67977 affects VillaTheme HAPPY versions up to 1.0.8 and is characterized by missing authorization checks. This incorrect access control configuration permits unauthorized users to perform actions that should require higher privileges, potentially leading to integrity and availability issues within the system. The CVSS 3.1 base score is 8.2, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. Confidentiality is not impacted, but integrity is high and availability is low impacted.

The vulnerability allows unauthorized modification or disruption of system functions due to missing authorization controls, impacting the integrity and availability of the affected system. There is no impact on confidentiality. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor VillaTheme's advisories for updates. Until a fix is available, restrict access to the affected system and review access control configurations to minimize exposure.