The vulnerability CVE-2025-69347 in Convers Lab WPSubscription allows attackers to bypass authorization controls by manipulating a user-controlled key. This occurs because of incorrectly configured access control security levels in the plugin versions up to 1.8.10. The CVSS 3.1 base score is 8.6, indicating a high severity with network attack vector, no privileges required, no user interaction, and impacts confidentiality (high), integrity (low), and availability (low). No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authorization mechanisms, potentially gaining unauthorized access to sensitive subscription data or functionality. The confidentiality impact is high, meaning sensitive information could be exposed. Integrity and availability impacts are low, indicating limited ability to alter data or disrupt service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality and monitoring for unusual activity related to subscription management. Avoid exposing the affected plugin to untrusted users where possible.