The vulnerability CVE-2025-69336 affects bdthemes Ultimate Store Kit Elementor Addons up to version 2.9.4 and is due to missing authorization controls. This allows users with limited privileges to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to certain features or data. The CVSS 3.1 base score is 4.3 (medium), with attack vector network, low attack complexity, requiring privileges, no user interaction, and limited confidentiality impact. No known exploits or patches are currently documented.

The impact is limited to a confidentiality loss with no integrity or availability impact. Attackers with some privileges could access unauthorized information or functionality due to missing authorization checks. There are no known exploits in the wild, and the overall risk is medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the affected plugin. Limit user privileges where possible to reduce risk exposure.