This vulnerability (CWE-862) in WPBakery Page Builder versions <= 8.7.2 allows subscriber-level users to bypass access controls, leading to unauthorized actions that impact the integrity of the system. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges but no user interaction. Confidentiality is not impacted, but integrity is compromised, and availability remains unaffected. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

An attacker with subscriber-level privileges can perform unauthorized actions due to missing authorization checks, potentially modifying or manipulating content or settings within the WPBakery Page Builder environment. This impacts the integrity of the affected system but does not affect confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for updates from Rain-Task Ltd. No official remediation or temporary fixes are currently documented.