This vulnerability in bdthemes Ultimate Post Kit (<= 4.0.21) involves missing authorization checks due to misconfigured access control. It allows users with some privileges (PR:L) to exploit the system without proper authorization, potentially leading to partial confidentiality and integrity impacts (C:L/I:L) but no availability impact. The vulnerability is network exploitable without user interaction (AV:N/UI:N) and affects the security scope (S:C). No official patch or mitigation details are provided in the available data.

The vulnerability could allow an attacker with limited privileges to perform unauthorized actions, potentially leading to partial disclosure and modification of data within the affected system. There is no indication of availability impact or widespread exploitation. The medium CVSS score reflects moderate risk due to the combination of network accessibility and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the Ultimate Post Kit plugin to ensure proper authorization enforcement. Monitor for vendor updates or security advisories that address this vulnerability.