This vulnerability in e-plugins Institutions Directory (<= 1.3.4) arises from incorrect privilege assignment, enabling an attacker with some privileges to escalate their access rights. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely over the network with low complexity, requires the attacker to have some privileges already, does not require user interaction, and can lead to high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with limited privileges to escalate their privileges to a higher level, potentially gaining full control over the affected system or data. This can lead to complete compromise of confidentiality, integrity, and availability of the Institutions Directory application and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users only and monitor for suspicious privilege escalation attempts. Avoid granting unnecessary privileges to users to reduce risk.