This vulnerability in Designinvento DirectoryPress (<= 3.6.26) involves missing authorization due to improperly configured access control security levels. It allows users with limited privileges to perform actions they should not be authorized to execute. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability can lead to unauthorized modification of data or limited disruption of service due to the low integrity and availability impacts. Confidentiality is not affected. Since the attack requires low privileges and no user interaction, it could be exploited by authenticated users with minimal effort. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in DirectoryPress to ensure proper authorization enforcement. Monitor for updates from Designinvento regarding patches or official mitigations.