The vulnerability identified as CVE-2026-25473 affects AA-Team's WZone plugin up to version 14.0.31. It is characterized by missing authorization checks, which result in incorrectly configured access control security levels. This can allow users with limited privileges to perform actions beyond their authorization, impacting the integrity and availability of the affected system. The CVSS v3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and causing integrity and availability impacts without confidentiality loss. No patch or vendor advisory is provided at this time.

Exploitation of this vulnerability could allow an attacker with some level of privileges to perform unauthorized actions that may alter data or disrupt service availability. Confidentiality is not affected. There are no known exploits in the wild, and the impact is limited to integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in WZone to ensure proper authorization enforcement. Monitor for vendor updates regarding patches or official mitigations.