The vulnerability identified as CVE-2026-25394 affects the Fitness FSE plugin by sparklewpthemes. It is caused by missing authorization checks due to incorrectly configured access control, which could allow users with limited privileges to perform unauthorized actions. The issue impacts versions up to 1.0.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low. No patch or vendor advisory is currently provided.

The impact is limited to integrity, meaning unauthorized users with some privileges might be able to modify data or perform actions beyond their intended permissions. There is no impact on confidentiality or availability. The medium severity rating reflects this limited but non-negligible risk. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations where possible to limit privilege escalation risks. Monitor for updates from sparklewpthemes regarding patches or official mitigations.