This vulnerability in Kaira StoreCustomizer arises from missing authorization checks, which means that certain actions or data may be accessible without proper permission validation. The issue affects versions up to 2.6.3 and allows attackers with low privileges to access sensitive data (confidentiality impact) without requiring user interaction. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impact limited to confidentiality.

The vulnerability can lead to unauthorized disclosure of sensitive information due to missing authorization controls. There is no indication of integrity or availability impact. Exploitation requires low privileges but no user interaction, making it moderately risky. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the StoreCustomizer plugin features to trusted users only and review access control configurations carefully.