This vulnerability in PublishPress Series (up to version 3.1.3) involves an authorization bypass through a user-controlled key in the organize-series functionality. The issue stems from incorrectly configured access control security levels, enabling an attacker with low privileges to bypass intended authorization restrictions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An attacker with low privileges can bypass authorization controls, potentially leading to limited integrity and availability impacts within the PublishPress Series plugin. There is no confidentiality impact reported. This could allow unauthorized modification or disruption of series organization functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official PublishPress communications for updates and apply any forthcoming patches promptly.