This vulnerability in gougucms 4.08.18 involves the reg_submit function of the User Registration Handler component, specifically in the Login.php file. An attacker can manipulate the 'level' argument, causing dynamically-determined object attributes to be set, which may lead to unintended behavior or security issues. The vulnerability is remotely exploitable without requiring user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. No patch or vendor advisory is available, and the vendor has not responded to the disclosure.

Successful exploitation could allow an attacker to influence object attributes dynamically during user registration, potentially leading to unauthorized actions or privilege escalation within the application. The exact impact depends on how the manipulated attributes affect application logic. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying temporary mitigations such as input validation or restricting access to the vulnerable function if possible. Monitor official channels for updates or patches.