This vulnerability in Business Roy by ikreatethemes is due to missing authorization, which results in incorrect access control configurations. It affects versions up to and including 1.1.4. The CVSS 3.1 base score is 4.3 (medium), with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts integrity only. No patch or vendor advisory is currently available, and no exploits are known in the wild.

The vulnerability allows an attacker with low privileges to exploit access control weaknesses, potentially leading to unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability. Since no known exploits exist in the wild, the immediate risk is limited but should be addressed to prevent potential misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and tighten access control configurations in Business Roy to prevent unauthorized actions. Monitor for vendor updates or patches addressing this issue.