This vulnerability in VillaTheme COMPE plugin versions up to 1.1.4 allows an attacker to bypass authorization controls by manipulating a user-controlled key due to misconfigured access control security levels. The flaw enables unauthorized access to certain functionality or data without requiring authentication or user interaction. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, impacting confidentiality but not integrity or availability. No official patch or fix has been published as of now, and no exploits have been observed in the wild.

An attacker can bypass authorization mechanisms in the affected VillaTheme COMPE plugin, potentially gaining unauthorized access to restricted data or functionality. The impact is limited to confidentiality loss without affecting integrity or availability. Since no exploits are known in the wild, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying strict access controls at the environment level or disabling the plugin if not essential may reduce exposure.