The vulnerability CVE-2026-25419 affects flycart UpsellWP versions up to 2.2.5 and is characterized by missing authorization controls in the checkout-upsell-and-order-bumps component. This incorrect access control configuration could allow an attacker with low privileges to access or manipulate certain features or data that should be restricted. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability effects.

The impact is limited to partial confidentiality loss due to missing authorization checks. There is no reported impact on integrity or availability. The vulnerability requires an attacker to have some privileges and can be exploited remotely over the network. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in the affected UpsellWP component. Monitor vendor communications for updates on patches or official mitigations.