The vulnerability identified as CVE-2026-25314 affects the WP Messiah TOP Table Of Contents WordPress plugin through missing authorization controls. Specifically, the plugin versions up to 1.3.31 do not properly enforce access control, allowing users with limited privileges to exploit the plugin's functionality beyond intended permissions. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in limited integrity impact without confidentiality or availability impact. No patch or official remediation information is currently available.

Exploitation of this vulnerability could allow an attacker with some level of privileges to perform unauthorized actions within the plugin, potentially modifying or interfering with its operation. The impact is limited to integrity, with no direct confidentiality or availability effects reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users that could exploit this vulnerability.