This vulnerability (CVE-2025-69138) affects Jthemes Genemy versions up to 1.6.6 and involves incorrect privilege assignment (CWE-266) that enables a subscriber-level user to escalate privileges. The CVSS 3.1 base score is 8.8, reflecting a network attack vector with low attack complexity, requiring low privileges but no user interaction, and resulting in high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation is not managed server-side.

Successful exploitation allows a subscriber to escalate privileges, potentially gaining unauthorized administrative or higher-level access. This can lead to full compromise of the system's confidentiality, integrity, and availability, enabling attackers to manipulate data, disrupt services, or gain control over the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit subscriber privileges where possible and monitor for unusual privilege escalations. Avoid granting unnecessary privileges to subscriber accounts.