This vulnerability in Themefic Tourfic (<= 2.22.5) arises from missing authorization checks, which means that certain actions or data may be accessible without proper permission validation. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. The impact is limited to confidentiality loss without integrity or availability impact. No vendor advisory or patch information is currently provided, and no exploits are known in the wild.

An attacker with low privileges can remotely exploit this vulnerability to gain unauthorized access to sensitive information, resulting in confidentiality compromise. There is no impact on integrity or availability according to the CVSS vector. This could lead to data exposure within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in the affected Tourfic plugin versions if possible. Monitor for vendor updates or security advisories addressing this issue.